• API
• AIX (1)
• Alpha (3)
• BSD (13)
• Cisco (3)
• Sco (1)
• FreeBSD (27)
• Hp-Ux (1)
• Irix (5)
• Linux (328)
• NetBSD (4)
• OpenBSD (4)
• OSX (16)
• Solaris (16)
• Windows (69)

API

Send a GET request; the s argument contains your keyword.

http://shell-storm.org/api/?s=<keyword>

Use * to search for several keywords at once.

/?s=<keyword1>*<keyword2>*<keyword3>

Each line of the output describes one shellcode:

<author 1>::::<platform 1>::::<shellcode title 1>::::<shellcode id 1>::::<shellcode url 1>
<author 2>::::<platform 2>::::<shellcode title 2>::::<shellcode id 2>::::<shellcode url 2>
<author 3>::::<platform 3>::::<shellcode title 3>::::<shellcode id 3>::::<shellcode url 3>

Shellcodes (491 entries)

Target	Description	Size	Author
AIX
Aix	execve /bin/sh	88 B	Georgi Guninski
Alpha
Alpha	/bin/sh	80 B	Lamont Granquist
Alpha	execve()	112 B	n/a
Alpha	setuid()	156 B	n/a
BSD
BSD/32bits	Passive Connection	126 B	Scrippie
BSD/ppc	execve(/bin/sh)	128 B	Palante
BSD/x86	setreuid(geteuid(), geteuid()) and execve(/bin/sh, /bin/sh, 0)	—	Jihyeog Lim
BSD/x86	setuid/execve	30 B	Marco Ivaldi
BSD/x86	setuid/portbind	94 B	Marco Ivaldi
BSD/x86	break chroot	45 B	Matias Sedalo
BSD/x86	cat /etc/master.passwd & mail root@localhost	92 B	Matias Sedalo
BSD/x86	execve(/bin/sh) & setuid(0)	29 B	Matias Sedalo
BSD/x86	bindshell on port 2525	167 B	beosroot
BSD/x86	execve /bin/sh Crypt /bin/sh	49 B	dev0id
BSD/x86	execve(/bin/sh)	27 B	n0gada
BSD/x86	Connect Back Port 6969	133 B	Marcetam
BSD/x86	back-connect TCP/2222	93 B	dev0id
Cisco
Cisco IOS	Connectback shellcode v1.0	—	Gyan Chawdhary
Cisco IOS	Tiny shellcode v1.0	—	Gyan Chawdhary
Cisco IOS	Bind shellcode v1.0	—	Varun Uppal
Sco
Sco/x86	execve(/bin/sh, ..., NULL)	43 B	minervini
FreeBSD
FreeBSD/x86-64	execve	28 B	Gitsnik
FreeBSD/x86-64	bind_tcp with passcode	127 B	Gitsnik
FreeBSD/x86-64	exec(/bin/sh) Shellcode	31 B	Hack'n Roll
FreeBSD/x86-64	execve /bin/sh shellcode	34 B	Hack'n Roll
FreeBSD/x86-64	Execve /bin/sh - Anti-Debugging	—	c0d3_z3r0
FreeBSD/x86	execve /tmp/sh	34 B	Claes M. Nyberg
FreeBSD/x86	execve /bin/sh	23 B	IZ
FreeBSD/x86	reboot(RB_AUTOBOOT)	7 B	IZ
FreeBSD/x86	bind port:4883 with auth shellcode	—	MahDelin
FreeBSD/x86	connect back /bin/sh.	81 B	Tosh
FreeBSD/x86	execv(/bin/sh)	23 B	Tosh
FreeBSD/x86	portbind shell + fork	111 B	Tosh
FreeBSD/x86	8.0-RELEASE - //sbin/pfctl -F all Shellcode	47 B	antrhacks
FreeBSD/x86	encrypted shellcode /bin/sh	48 B	c0d3_z3r0
FreeBSD/x86	kldload /tmp/o.o	74 B	dev0id
FreeBSD/x86	/bin/sh	23 B	marcetam
FreeBSD/x86	execve /bin/sh	37 B	preedator
FreeBSD/x86	portbind shellcode	167 B	sbz
FreeBSD/x86	execve(/bin/cat & /etc/master.passwd)	65 B	sm4x
FreeBSD/x86	reverse connect dl(shellcode) and execute, exit	90 B	sm4x
FreeBSD/x86	reverse portbind /bin/sh	89 B	sm4x
FreeBSD/x86	setuid(0)&execve({//sbin/ipf,-Faa,0},0);	57 B	sm4x
FreeBSD/x86	connect back.send.exit /etc/passwd	112 B	suN8Hclf
FreeBSD/x86	kill all processes	12 B	suN8Hclf
FreeBSD/x86	setreuid(0, 0) & execve(pfctl -d)	56 B	suN8Hclf
FreeBSD/x86	bind sh port 41254	115 B	zillion
FreeBSD/x86	reboot()	15 B	zillion
Hp-Ux
Hp-Ux	execve(/bin/sh)	58 B	K2
Irix
Irix	execve(/bin/sh -c)	72 B	n/a
Irix	execve(/bin/sh)	43 B	n/a
Irix	Bind Port	364 B	scut/teso
Irix	execve(/bin/sh)	68 B	scut/teso
Irix	stdin-read shellcode	40 B	scut/teso
Linux
Linux/ARM	execve("/bin/sh", NULL, 0)	34 B	Jonathan 'dummys' Borgeaud
Linux/ARM	Add map in /etc/hosts file	79 B	Osanda Malith Jayathissa
Linux/ARM	chmod("/etc/passwd", 0777)	39 B	gunslinger_
Linux/ARM	creat("/root/pwned", 0777)	39 B	gunslinger_
Linux/ARM	execve("/bin/sh", [], [0 vars])	35 B	gunslinger_
Linux/ARM	Bind Connect UDP Port 68	—	Daniel Godas-Lopez
Linux/ARM	Bindshell port 0x1337	—	Daniel Godas-Lopez
Linux/ARM	Loader Port 0x1337	—	Daniel Godas-Lopez
Linux/ARM	ifconfig eth0 and Assign Address	—	Daniel Godas-Lopez
Linux/ARM	chmod(/etc/shadow, 0777) Shellcode	35 B	Florian Gaultier
Linux/ARM	polymorphic chmod(/etc/shadow, 0777)	84 B	Florian Gaultier
Linux/ARM	Polymorphic execve("/bin/sh", ["/bin/sh"], NULL); - XOR	78 B	Jonathan Salwan
Linux/ARM	execve(/bin/sh, /bin/sh, 0)	30 B	Jonathan Salwan
Linux/ARM	execve(/bin/sh, [0], [0 vars])	27 B	Jonathan Salwan
Linux/ARM	execve(/bin/sh,NULL,0)	31 B	Jonathan Salwan
Linux/ARM	setuid(0) & execve(/bin/sh, /bin/sh, 0)	38 B	Jonathan Salwan
Linux/ARM	connect back /bin/sh.	79 B	Neil Klopfenstein
Linux/ARM	chmod(/etc/shadow, 0777)	41 B	midnitesnake
Linux/ARM	execve(/bin/sh, [0], [0 vars])	30 B	midnitesnake
Linux/ARM	reverse_shell(tcp,10.1.1.2,0x1337)	—	midnitesnake
Linux/StrongARM	bind() portshell	203 B	funkysh
Linux/StrongARM	execve()	47 B	funkysh
Linux/StrongARM	setuid()	20 B	funkysh
Linux/SuperH	sh4 - Bind /bin/sh on port 31337	—	Dad`
Linux/SuperH	sh4 execve(/bin/sh, 0, 0)	19 B	Florian Gaultier
Linux/SuperH	sh4 - setuid(0) ; execve(/bin/sh, NULL, NULL)	27 B	Jonathan Salwan
Linux/mips	Reverse Shell Shellcode	200 B	Jacob Holcomb
Linux/mips	execve(/bin/sh)	56 B	core
Linux/mips	execve(/bin/sh, */bin/sh, 0)	52 B	entropy
Linux/mips	add user(UID 0) with password	164 B	rigan
Linux/mips	connect back shellcode (port 0x7a69)	168 B	rigan
Linux/mips	execve /bin/sh	48 B	rigan
Linux/mips	reboot()	32 B	rigan
Linux/mips	execve(/bin/sh,[/bin/sh],[]);	60 B	vaicebine
Linux/mips	port bind 4919	276 B	vaicebine
Linux/ppc	connect back execve /bin/sh	240 B	Charles Stevenson
Linux/ppc	execve /bin/sh	60 B	Charles Stevenson
Linux/ppc	read & exec shellcode	32 B	Charles Stevenson
Linux/ppc	execve /bin/sh	112 B	Palante
Linux/sparc	[setreuid(0,0); execve() of /bin/sh]	64 B	anathema
Linux/sparc	Portbind 8975/tcp	284 B	killah
Linux/sparc	connect back	216 B	killah
Linux/sparc	setreuid(0,0)&standard execve()	72 B	michel kaempf
Linux/CRISv32	Connect Back Shellcode	189 B	bashis
Linux/RISC-V64	execve(/bin/sh, NULL, 0)	34 B	Christina Quast
Linux/x86-64	execve("/bin/bash",{NULL},{NULL})	24 B	Joao
Linux/x86-64	Dynamic null-free reverse TCP shell	65 B	Philippe Dugre
Linux/x86-64	execveat("/bin//sh")	29 B	ZadYree, vaelio and DaShrooms
Linux/x86-64	Add map in /etc/hosts file	110 B	Osanda Malith Jayathissa
Linux/x86-64	Connect Back Shellcode	139 B	MadMouse
Linux/x86-64	access() Egghunter	49 B	Doreth.Z10
Linux/x86-64	Shutdown	64 B	Keyman
Linux/x86-64	Read password	105 B	Keyman
Linux/x86-64	Password Protected Reverse Shell	136 B	Keyman
Linux/x86-64	Password Protected Bind Shell	147 B	Keyman
Linux/x86-64	Add root - Polymorphic	273 B	Keyman
Linux/x86-64	Bind TCP stager with egghunter	157 B	Christophe G
Linux/x86-64	Add user and password with open,write,close	358 B	Christophe G
Linux/x86-64	Add user and password with echo cmd	273 B	Christophe G
Linux/x86-64	Read /etc/passwd	82 B	Mr.Un1k0d3r
Linux/x86-64	shutdown -h now	65 B	Osanda Malith Jayathissa
Linux/x86-64	TCP Bind 4444 with password	173 B	Christophe G
Linux/x86-64	TCP reverse shell with password	138 B	Andriy Brukhovetskyy
Linux/x86-64	TCP bind shell with password	175 B	Andriy Brukhovetskyy
Linux/x86-64	Reads data from /etc/passwd to /tmp/outfile	118 B	Chris Higgins
Linux/x86-64	shell bind TCP random port	57 B	Geyslan G. Bem
Linux/x86-64	TCP bind shell	150 B	Russell Willis
Linux/x86-64	Reverse TCP shell	118 B	Russell Willis
Linux/x86-64	add user with passwd	189 B	0_o
Linux/x86-64	execve(/sbin/iptables, [/sbin/iptables, -F], NULL)	49 B	10n1z3d
Linux/x86-64	Execute /bin/sh	27 B	Dad`
Linux/x86-64	bind-shell with netcat	131 B	Gaussillusion
Linux/x86-64	connect back shell with netcat	109 B	Gaussillusion
Linux/x86-64	setreuid(0,0) execve(/bin/ash,NULL,NULL) + XOR	85 B	egeektronic
Linux/x86-64	setreuid(0,0) execve(/bin/csh, [/bin/csh, NULL]) + XOR	87 B	egeektronic
Linux/x86-64	setreuid(0,0) execve(/bin/ksh, [/bin/ksh, NULL]) + XOR	87 B	egeektronic
Linux/x86-64	setreuid(0,0) execve(/bin/zsh, [/bin/zsh, NULL]) + XOR	87 B	egeektronic
Linux/x86-64	bindshell port:4444 shellcode	132 B	evil.xi4oyu
Linux/x86-64	setuid(0) + execve(/bin/sh)	49 B	evil.xi4oyu
Linux/x86-64	execve(/bin/sh, [/bin/sh], NULL)	33 B	hophet
Linux/x86-64	execve(/bin/sh);	30 B	zbt
Linux/x86-64	reboot(POWER_OFF)	19 B	zbt
Linux/x86-64	sethostname() & killall	33 B	zbt
Linux/x86	setuid + setgid + stdin re-open + exceve	71 B	Andres C. Rodriguez (acamro)
Linux/x86	Followtheleader custom execve-shellcode Encoder/Decoder	136 B	Konstantinos Alexiou
Linux/x86	ROT-7 Decoder execve	74 B	Stavros Metzidakis
Linux/x86	Add map in /etc/hosts file	77 B	Javier Tejedor
Linux/x86	Obfuscated - chmod({passwd,shadow}) - add new root user - exec /bin/sh	512 B	Ali Razmjoo
Linux/x86	setreuid() + exec /usr/bin/python	54 B	Ali Razmjoo
Linux/x86	chmod + Add new root user with password + exec sh	378 B	Ali Razmjoo
Linux/x86	Shell Reverse TCP Shellcode	74 B	Julien Ahrens
Linux/x86	Shell Bind TCP Shellcode Port 1337	89 B	Julien Ahrens
Linux/x86	sockfd trick + dup2(0,0),dup2(0,1),dup2(0,2) + execve /bin/sh	50 B	ZadYree
Linux/x86	shutdown -h now	56 B	Osanda Malith Jayathissa
Linux/x86	chmod 0777 /etc/shadow (a bit obfuscated) Shellcode	51 B	Osanda Malith Jayathissa
Linux/x86	/bin/nc -le /bin/sh -vp 17771	58 B	Oleg Boytsev
Linux/x86	JMP-FSTENV execve shell	67 B	Paolo Stivanin
Linux/x86	shift-bit-encoder execve	114 B	Shihao Song
Linux/x86	Copy /etc/passwd to /tmp/outfile	97 B	Paolo Stivanin
Linux/x86	jump-call-pop execve shell	52 B	Paolo Stivanin
Linux/x86	Download + chmod + exec	108 B	Daniel Sauder
Linux/x86	reads /etc/passwd and sends the content to 127.1.1.1 port 12345	111 B	Daniel Sauder
Linux/x86	Multi-Egghunter	—	Ryan Fenno
Linux/x86	Obfuscated tcp bind shell	112 B	Russell Willis
Linux/x86	Obfuscated execve /bin/sh	30 B	Russell Willis
Linux/x86	egghunter shellcode	—	Russell Willis
Linux/x86	Reverse TCP bind shell	92 B	Russell Willis
Linux/x86	Set /proc/sys/net/ipv4/ip_forward to 0 & exit()	83 B	Hamid Zamani
Linux/x86	TCP bind shell	108 B	Russell Willis
Linux/x86	Encrypted execve /bin/sh with uzumaki algorithm	50 B	Geyslan G. Bem
Linux/x86	Mutated Execve Wget	96 B	Geyslan G. Bem
Linux/x86	Mutated Fork Bomb	15 B	Geyslan G. Bem
Linux/x86	Mutated Reboot	55 B	Geyslan G. Bem
Linux/x86	Tiny read /etc/passwd file	51 B	Geyslan G. Bem
Linux/x86	Tiny Execve sh Shellcode	21 B	Geyslan G. Bem
Linux/x86	Insertion Decoder Shellcode - 33+ bytes	—	Geyslan G. Bem
Linux/x86	Egg Hunter Shellcode	38 B	Geyslan G. Bem
Linux/x86	Tiny Shell Reverse TCP	67 B	Geyslan G. Bem
Linux/x86	Tiny Shell Bind TCP Random Port	57 B	Geyslan G. Bem
Linux/x86	Tiny Shell Bind TCP	73 B	Geyslan G. Bem
Linux/x86	Shell Bind TCP (GetPC/Call/Ret Method)	89 B	Geyslan G. Bem
Linux/x86	append /etc/passwd & exit()	107 B	$andman
Linux/x86	unlink(/etc/passwd) & exit()	35 B	$andman
Linux/x86	connect back&send&exit /etc/shadow	155 B	0in
Linux/x86	execve read shellcode	92 B	0ut0fbound
Linux/x86	egghunt shellcode	29 B	Ali Raheem
Linux/x86	nc -lvve/bin/sh -p13377	62 B	Anonymous
Linux/x86	/bin/sh Null-Free Polymorphic	46 B	Aodrulez
Linux/x86	execve() Diassembly Obfuscation Shellcode	32 B	BaCkSpAcE
Linux/x86	SET_IP() Connectback Shellcode	82 B	Benjamin Orozco
Linux/x86	SET_PORT() portbind	100 B	Benjamin Orozco
Linux/x86	netcat bindshell port 8080	75 B	Blake
Linux/x86	netcat connect back port 8080	76 B	Blake
Linux/x86	adds a root user no-passwd to /etc/passwd	83 B	Bob [Dtors.net]
Linux/x86	chmod(//bin/sh ,04775); set sh +s	31 B	Bob [Dtors.net]
Linux/x86	execve()/bin/ash; exit;	34 B	Bob [Dtors.net]
Linux/x86	setuid(); execve(); exit();	44 B	Bob [Dtors.net]
Linux/x86	setreuid(0, 0) + execve(/bin//sh, [/bin//sh, -c, cmd], NULL);	—	Bunker
Linux/x86	dup2(0,0); dup2(0,1); dup2(0,2);	15 B	Charles Stevenson
Linux/x86	exit(1)	7 B	Charles Stevenson
Linux/x86	if(read(fd,buf,512)<=2) _exit(1) else buf();	29 B	Charles Stevenson
Linux/x86	read(0,buf,2541); chmod(buf,4755);	23 B	Charles Stevenson
Linux/x86	execve(/bin/dash)	49 B	Chroniccommand
Linux/x86	Audio (knock knock knock) via /dev/dsp+setreuid(0,0)+execve()	566 B	Cody Tubbs
Linux/x86	Surprise ! ! !	361 B	Florian Gaultier
Linux/x86	Write FS PHP Connect Back Utility Shellcode	508 B	GS2008
Linux/x86	Bind TCP Port - with SO_REUSEADDR set (Avoiding SIGSEGV)	103 B	Geyslan G. Bem
Linux/x86	Shell Bind TCP Random Port	65 B	Geyslan G. Bem
Linux/x86	Shell Reverse TCP Shellcode	72 B	Geyslan G. Bem
Linux/x86	Password Authentication portbind port 64713/tcp	166 B	Gotfault Security
Linux/x86	portbind port 64713	86 B	Gotfault Security
Linux/x86	setreuid(0,0) + execve(/bin/sh, [/bin/sh, NULL])	33 B	Gotfault Security
Linux/x86	setuid(0) setgid(0) execve("/bin/sh", ["/bin/sh", NULL])	37 B	Gotfault Security
Linux/x86	Force Reboot shellcode	36 B	Hamza Megahed
Linux/x86	Remote Port forwarding	87 B	Hamza Megahed
Linux/x86	execve /bin/sh shellcode	23 B	Hamza Megahed
Linux/x86	execve-chmod 0777 /etc/shadow	57 B	Hamza Megahed
Linux/x86	iptables --flush	43 B	Hamza Megahed
Linux/x86	ASLR deactivation	83 B	Jean Pascal Pereira
Linux/x86	chmod 666 /etc/passwd & /etc/shadow	57 B	Jean Pascal Pereira
Linux/x86	execve(/bin/sh)	28 B	Jean Pascal Pereira
Linux/x86	///sbin/iptables -POUTPUT DROP	60 B	John Babio
Linux/x86	/etc/init.d/apparmor teardown	53 B	John Babio
Linux/x86	/usr/bin/killall snort	46 B	John Babio
Linux/x86	/bin/sh polymorphic shellcode	48 B	Jonathan Salwan
Linux/x86	ConnectBack with SSL connection	422 B	Jonathan Salwan
Linux/x86	Remote file Download	42 B	Jonathan Salwan
Linux/x86	execve(/bin/bash, [/bin/sh, -p], NULL)	33 B	Jonathan Salwan
Linux/x86	polymorphic execve(/bin/bash, [/bin/sh, -p], NULL)	57 B	Jonathan Salwan
Linux/x86	/bin/sh	8 B	JungHoon Shin
Linux/x86	add root user (r00t) with no password to /etc/passwd	—	Kris Katterjohn
Linux/x86	chmod(/etc/shadow, 0666) & exit()	—	Kris Katterjohn
Linux/x86	execve(rm -rf /)	45 B	Kris Katterjohn
Linux/x86	forkbomb	7 B	Kris Katterjohn
Linux/x86	ipchains -F	40 B	Kris Katterjohn
Linux/x86	kill all processes	11 B	Kris Katterjohn
Linux/x86	set system time to 0 & exit	—	Kris Katterjohn
Linux/x86	setuid(0) setgid(0) execve(echo 0 > /proc/sys/kernel/randomize_va_space)	79 B	LiquidWorm
Linux/x86	DoS-Badger-Game	6 B	Magnefikko
Linux/x86	SLoc-DoS shellcode	55 B	Magnefikko
Linux/x86	bind sh@64533	97 B	Magnefikko
Linux/x86	chmod(/etc/shadow, 0666)	36 B	Magnefikko
Linux/x86	chmod(/etc/shadow, 0777)	29 B	Magnefikko
Linux/x86	execve(/bin/sh)	25 B	Magnefikko
Linux/x86	execve(a->/bin/sh)	14 B	Magnefikko
Linux/x86	setreud(getuid(), getuid()) & execve(/bin/sh)	34 B	Magnefikko
Linux/x86	setuid(0) ^ execve(/bin/sh, 0, 0)	27 B	Magnefikko
Linux/x86	setuid(0) + execve(/bin/sh,...)	29 B	Marcin Ulikowski
Linux/x86	re-use of (/bin/sh) string in .rodata	16 B	Marco Ivaldi
Linux/x86	setuid/portbind port 31337 TCP	96 B	Marco Ivaldi
Linux/x86	stdin re-open and /bin/sh execute	—	Marco Ivaldi
Linux/x86	add user t00r ENCRYPT	116 B	Matias Sedalo
Linux/x86	chmod 666 /etc/shadow	41 B	Matias Sedalo
Linux/x86	chmod 666 shadow ENCRYPT	75 B	Matias Sedalo
Linux/x86	execve /bin/sh encrypted	58 B	Matias Sedalo
Linux/x86	portbind a shell in port 5074	92 B	Matias Sedalo
Linux/x86	execve /bin/sh anti-ids	40 B	NicatiN
Linux/x86	/bin/cp /bin/sh /tmp/katy & chmod 4555	126 B	RaiSe
Linux/x86	execve(/bin//sh/,[/bin//sh],NULL)	22 B	Revenge
Linux/x86	setuid(0) + execve(/bin//sh, [/bin//sh], NULL)	28 B	Revenge
Linux/x86	Port Bind 4444 ( xor-encoded )	152 B	Rick
Linux/x86	edit /etc/sudoers for full access	86 B	Rick
Linux/x86	Connect Back shellcode	90 B	Russell Sanford
Linux/x86	socket-proxy	372 B	Russell Sanford
Linux/x86	[setreuid()] -> [/sbin/iptables -F] -> [exit(0)]	76 B	Sh3llc0d3
Linux/x86	Add root user /etc/passwd	104 B	Shok
Linux/x86	iptables -F	49 B	Sp4rK
Linux/x86	execve(/sbin/halt,/sbin/halt)	27 B	TheWorm
Linux/x86	execve(/sbin/reboot,/sbin/reboot)	28 B	TheWorm
Linux/x86	execve(/sbin/shutdown,/sbin/shutdown 0)	36 B	TheWorm
Linux/x86	exit(0) 3 bytes or exit(1)	4 B	TheWorm
Linux/x86	setuid(0) & execve(/bin/sh,0)	25 B	TheWorm
Linux/x86	setuid(0), setgid(0) & execve(/bin/sh,[/bin/sh,NULL])	33 B	TheWorm
Linux/x86	System Beep	45 B	Thomas Rinsma
Linux/x86	Bindshell TCP/5074	226 B	Tora
Linux/x86	iptables -F	45 B	UnboundeD
Linux/x86	Connect-Back port UDP/54321	151 B	XenoMuta
Linux/x86	append rsa key to /root/.ssh/authorized_keys2	295 B	XenoMuta
Linux/x86	listens for shellcode on tcp/5555 and jumps to it	83 B	XenoMuta
Linux/x86	Self-modifying ShellCode for IDS evasion	64 B	Xenomuta
Linux/x86	shellcode that forks a HTTP Server on port tcp/8800	166 B	Xenomuta
Linux/x86	stagger that reads second stage shellcode (127 bytes maximum) from stdin	14 B	_fkz
Linux/x86	alphanumeric Bomb FORK Shellcode	117 B	agix
Linux/x86	chmod(/etc/shadow, 0666) ASCII	443 B	agix
Linux/x86	pwrite(/etc/shadow, hash, 32, 8)	89 B	agix
Linux/x86	Polymorphic - setuid(0) + chmod(/etc/shadow, 0666)	61 B	antrhacks
Linux/x86	execve(/bin/cat, /etc/shadow, NULL)	42 B	antrhacks
Linux/x86	setuid(0) + chmod(/etc/shadow, 0666)	37 B	antrhacks
Linux/x86	setreuid(geteuid(),geteuid()),execve(/bin/sh,0,0)	34 B	blue9057
Linux/x86	/bin/sh sysenter Opcode Array Payload	23 B	c0ntex & BaCkSpAcE
Linux/x86	File Reader /etc/passwd	65 B	certaindeath
Linux/x86	sends Phuck3d! to all terminals	60 B	condis
Linux/x86	upload & exec	189 B	cybertronic
Linux/x86	File unlinker 18 bytes + file path length	—	darkjoker
Linux/x86	Perl script execution 99 bytes + script length	—	darkjoker
Linux/x86	iptables -F	58 B	dev0id
Linux/x86	symlink /bin/sh xoring	56 B	dev0id
Linux/x86	iopl(3); asm(cli); while(1){}	12 B	dun
Linux/x86	SWAP restore	109 B	dx & spud
Linux/x86	SWAP store	99 B	dx & spud
Linux/x86	/sbin/iptables --flush	69 B	eSDee [Netric .org]
Linux/x86	connect back shellcode (port=0xb0ef)	131 B	eSDee [Netric .org]
Linux/x86	forking portbind shellcode - port=0xb0ef(45295)	200 B	eSDee [Netric .org]
Linux/x86	setreuid(0,0) execve("/bin/zsh", [/bin/zsh, NULL]) + XOR	53 B	egeektronic
Linux/x86	setreuid(0,0) execve("/bin/csh", [/bin/csh, NULL]) + XOR	53 B	egeektronic
Linux/x86	setreuid(0,0) execve("/bin/ksh", [/bin/ksh, NULL]) + XOR	53 B	egeektronic
Linux/x86	setreuid(0,0) execve(/bin/ash,NULL,NULL) + XOR	58 B	egeektronic
Linux/x86	bin/cat /etc/passwd	43 B	fb1h2s
Linux/x86	execve()	51 B	fl0 fl0w
Linux/x86	Find all writeable folder in filesystem linux polymorphic shellcode	—	gunslinger_
Linux/x86	Polymorphic bindport to 13123	125 B	gunslinger_
Linux/x86	Polymorphic bindport to 31337 with setreuid (0,0)	131 B	gunslinger_
Linux/x86	bind port to 6678 XOR encoded polymorphic	125 B	gunslinger_
Linux/x86	cdrom ejecting shellcode	46 B	gunslinger_
Linux/x86	chown root:root /bin/sh	48 B	gunslinger_
Linux/x86	force unmount /media/disk	33 B	gunslinger_
Linux/x86	give all user root access when execute /bin/sh	45 B	gunslinger_
Linux/x86	hard reboot (without any message) and data not lost	33 B	gunslinger_
Linux/x86	hard reboot (without any message) and data will be lost	29 B	gunslinger_
Linux/x86	nc -lp 31337 -e /bin//sh polymorphic	91 B	gunslinger_
Linux/x86	polymorphic cdrom ejecting	74 B	gunslinger_
Linux/x86	setdomainname to (th1s s3rv3r h4s b33n h1j4ck3d !!)	—	gunslinger_
Linux/x86	sys_chmod(/etc/shadow, 599)	39 B	gunslinger_
Linux/x86	sys_execve(/bin/sh, -c, ping localhost)	55 B	gunslinger_
Linux/x86	sys_exit(0)	8 B	gunslinger_
Linux/x86	sys_kill(-1,9)	11 B	gunslinger_
Linux/x86	sys_rmdir(/tmp/willdeleted)	41 B	gunslinger_
Linux/x86	sys_sethostname(PwNeD !!, 8)	32 B	gunslinger_
Linux/x86	sys_setuid(0) & sys_setgid(0) & execve (/bin/sh)	39 B	gunslinger_
Linux/x86	sys_sync	6 B	gunslinger_
Linux/x86	unlink /etc/shadow	33 B	gunslinger_
Linux/x86	Reverse Telnet	—	hts
Linux/x86	execve /bin/sh	21 B	ipv
Linux/x86	HTTP/1.x GET, Downloads & execve() - 111 bytes+	—	izik
Linux/x86	HTTP/1.x GET, Downloads and JMP - 68 bytes+	—	izik
Linux/x86	anti-debug trick (INT 3h trap) execve(/bin/sh, [/bin/sh, NULL], NULL)	39 B	izik
Linux/x86	cat /dev/urandom > /dev/console, no real profit just for kicks	63 B	izik
Linux/x86	eject & close cd-rom frenzy loop (follows /dev/cdrom symlink)	45 B	izik
Linux/x86	execve /bin/sh xored for Intel x86 CPUID	41 B	izik
Linux/x86	execve(/bin/sh, [/bin/sh, NULL]) + Bitmap	27 B	izik
Linux/x86	execve(/bin/sh, [/bin/sh, NULL]) + RIFF Header	28 B	izik
Linux/x86	execve(/bin/sh, [/bin/sh, NULL]) + RTF header	30 B	izik
Linux/x86	execve(/bin/sh, [/bin/sh, NULL]) + ZIP Header	28 B	izik
Linux/x86	execve(/bin/sh, [/bin/sh], NULL) / encoded by +1	39 B	izik
Linux/x86	open cd-rom loop (follows /dev/cdrom symlink)	39 B	izik
Linux/x86	quick (yet conditional, eax != 0 and edx == 0) exit	4 B	izik
Linux/x86	chmod(/etc/shadow, 0666) & exit()	33 B	ka0x
Linux/x86	setuid(0) & execve(/bin/cat /etc/shadow)	49 B	ka0x
Linux/x86	setuid(0) & execve(/sbin/poweroff -f)	47 B	ka0x
Linux/x86	execve (/bin/sh)	21 B	kernel_panik
Linux/x86	Bindport TCP/3879	—	lamagra
Linux/x86	connect back, download a file and execute	149 B	militan
Linux/x86	raw-socket ICMP/checksum shell	235 B	mu-b
Linux/x86	hence dropping a SUID root shell in /tmp	126 B	n/a
Linux/x86	kill snort	151 B	nob0dy
Linux/x86	setreuid & execve	31 B	oc192
Linux/x86	rm -rf / which attempts to block the process from being stopped	132 B	onionring
Linux/x86	portbind (define your own port)	84 B	oveRet
Linux/x86	setuid(0)+setgid(0)+add user iph without password	124 B	pentesters.ir
Linux/x86	break chroot execve /bin/sh	80 B	preedator
Linux/x86	Search html,html writable files and add your code - 380+ bytes	—	rigan
Linux/x86	chmod 666 /etc/shadow	27 B	root@thegibson
Linux/x86	eject /dev/cdrom	42 B	root@thegibson
Linux/x86	kill all processes	9 B	root@thegibson
Linux/x86	overwrite MBR on /dev/sda with LOL!	43 B	root@thegibson
Linux/x86	execve(/bin/sh,0,0)	21 B	sToRm
Linux/x86	portbind /bin/sh (port 64713)	83 B	sToRm
Linux/x86	setuid(0) & execve(/bin/sh,0,0)	28 B	sToRm
Linux/x86	setresuid(0,0,0); execve /bin/sh; exit;	41 B	sacrine
Linux/x86	setuid(0) & execve(/bin/sh,0,0)	28 B	sch3m4
Linux/x86	disabled modsecurity	64 B	sekfault
Linux/x86	shared memory exec	50 B	sloth
Linux/x86	chmod(/etc/shadow, 0777)	33 B	sm0k
Linux/x86	setresuid(0,0,0)-/bin/sh	35 B	sorrow
Linux/x86	Add User USER=t00r PASS=t00r - Encoder PexFnstenvSub	116 B	vlad902
Linux/x86	disables shadowing	42 B	vlan7
Linux/x86	setuid() & execve()	27 B	vlan7
Linux/x86	examples of long-term payloads hide-wait-change - 187 bytes+	—	xort & izik
Linux/x86	Alpha-Numeric using IMUL Method	88 B	xort
Linux/x86	Magic Byte Self Modifying Code for surviving - execve() _exit()	76 B	xort
Linux/x86	Radically Self Modifying Code - execve & _exit()	70 B	xort
Linux/x86	alpha-numeric	64 B	xort
Linux/x86	examples of long-term payloads hide-wait-change (.s)	—	xort
Linux/x86	add a passwordless local root account w000t	177 B	zillion
Linux/x86	execve of /bin/sh /tmp/p00p	70 B	zillion
Linux/x86	execve of /sbin/ipchains -F	70 B	zillion
Linux/x86	execve() of /sbin/iptables -F	70 B	zillion
Linux/x86	mkdir() & exit()	36 B	zillion
NetBSD
NetBSD/x86	kill all processes shellcode	23 B	Anonymous
NetBSD/x86	execve(/bin/sh)	68 B	humble
NetBSD/x86	callback (port 6666)	83 B	minervini
NetBSD/x86	setreuid(0, 0); execve(/bin//sh, ..., NULL);	29 B	minervini
OpenBSD
OpenBSD/x86	reboot()	15 B	beosroot
OpenBSD/x86	execve(/bin/sh)	23 B	hophet
OpenBSD/x86	add user w00w00	112 B	n/a
OpenBSD/x86	portbind port 6969	148 B	noir
OSX
Osx/ppc	Add user r00t	219 B	B-r00t
Osx/ppc	add inetd backdoor	222 B	B-r00t
Osx/ppc	create /tmp/suid	122 B	B-r00t
Osx/ppc	remote findsock by recv() key shellcode	—	Dino Dai Zovi
Osx/ppc	Single Reverse TCP	—	H D Moore
Osx/ppc	stager sock find peek	—	H D Moore
Osx/ppc	stager sock find	—	H D Moore
Osx/ppc	stager sock reverse	—	H D Moore
Osx/ppc	Bind Shell PORT TCP/8000 - encoder OSXPPCLongXOR	300 B	H D moore
Osx/ppc	shellcode execve(/bin/sh)	—	ghandi
Osx/ppc	execve(/bin/sh,[/bin/sh],NULL)& exit()	72 B	haphet
Osx/ppc	sync(), reboot()	32 B	haphet
Osx/x86-64	setuid shell x86_64	51 B	Dustin Schultz
Osx/x86-64	reverse tcp shellcode	131 B	Jacob Hammack
Osx/x86-64	universal OSX dyld ROP shellcode	—	pa_kt
Osx/x86	execve(/bin/sh)	24 B	Simon Derouineau
Solaris
Solaris/mips	connect-back (with XNOR encoded session)	600 B	Russell Sanford
Solaris/mips	download and execute	278 B	Russell Sanford
Solaris/sparc	setreuid(geteuid()), setregid(getegid()), execve /bin/sh	—	Claes M. Nyberg
Solaris/sparc	Bind /bin/sh TCP port 2001	—	ghandi
Solaris/sparc	portbind | port 6666	240 B	lhall
Solaris/sparc	setreuid	56 B	lhall
Solaris/sparc	execve(/bin/sh)	52 B	LSD
Solaris/sparc	Single bind TCP shell	—	vlad902
Solaris/x86	setuid(0) /bin/cat //etc/shadow	61 B	John Babio
Solaris/x86	Remote Download file	79 B	Jonathan Salwan
Solaris/x86	execve(/bin/sh, /bin/sh, NULL)	27 B	Jonathan Salwan
Solaris/x86	add services and execve inetd	201 B	n/a
Solaris/x86	execve /bin/sh toupper evasion	84 B	n/a
Solaris/x86	execve /bin/sh	43 B	shellcode.com.ar
Solaris/x86	setuid(0)&execve(//bin/sh)&exit(0)	39 B	sm4x
Solaris/x86	setuid(0)&execve(/bin/cat, /etc/shadow)&exit(0)	59 B	sm4x
Windows
Windows/64	Obfuscated Shellcode x86/x64 Download And Execute [Use PowerShell] - Generator	—	Ali Razmjoo
Windows/64	Add Admin, enable RDP, stop firewall and start terminal service	1218 B	Ali Razmjoo
Windows/64	(URLDownloadToFileA) download and execute - 218+ bytes	—	Weiss
Windows/64	Windows Seven x64 (cmd)	61 B	agix
Windows	Add Admin, enable RDP, stop firewall and start terminal service	1218 B	Ali Razmjoo
Windows	Add Admin User Shellcode	194 B	Giuseppe D'Amore
Windows	Safari JS JITed shellcode - exec calc (ASLR/DEP bypass)	—	Alexey Sintsov
Windows	Vista/7/2008 - download and execute file via reverse DNS channel	—	Alexey Sintsov
Windows	sp2 (En + Ar) cmd.exe	23 B	AnTi SeCuRe
Windows	add new local administrator	326 B	Anastasios Monachos
Windows	pro sp3 (EN) - add new local administrator	113 B	Anastasios Monachos
Windows	xp sp2 PEB ISbeingdebugged shellcode	56 B	Anonymous
Windows	XP Pro Sp2 English Message-Box Shellcode	16 B	Aodrulez
Windows	XP Pro Sp2 English Wordpad Shellcode	15 B	Aodrulez
Windows	Write-to-file Shellcode	—	Brett Gervasoni
Windows	telnetbind by winexec	111 B	DATA_SNIPER
Windows	useradd shellcode for russian systems	318 B	Darkeagle
Windows	XP SP3 English MessageBoxA	87 B	Glafkos Charalambous
Windows	SP2 english ( calc.exe )	37 B	Hazem mofeed
Windows	SP3 english ( calc.exe )	37 B	Hazem mofeed
Windows	Shellcode (cmd.exe) for XP SP2 Turkish	26 B	Hellcode
Windows	Shellcode (cmd.exe) for XP SP3 English	26 B	Hellcode
Windows	XP SP3 EN Calc Shellcode	16 B	John Leitch
Windows	win32/PerfectXp-pc1/sp3 (Tr) Add Admin Shellcode	112 B	KaHPeSeSe
Windows	PEB Kernel32.dll ImageBase Finder	49 B	Koshi
Windows	PEB Kernel32.dll ImageBase Finder Alphanumeric	67 B	Koshi
Windows	PEB!NtGlobalFlags shellcode	14 B	Koshi
Windows	XP sp3 (Ru) WinExec+ExitProcess cmd shellcode	12 B	Lord Kelvin
Windows	Reverse Generic Shellcode w/o Loader	249 B	Matthieu Suiche
Windows	Pop up message box (XP/SP2)	110 B	Omega7
Windows	sp3 (FR) Sleep	14 B	Optix
Windows	XP download and exec source	—	Peter Winter-Smith
Windows	Allwin MessageBoxA	238 B	RubberDuck
Windows	Allwin WinExec add new local administrator + ExitProcess Shellcode	272 B	RubberDuck
Windows	Allwin WinExec cmd.exe + ExitProcess Shellcode	195 B	RubberDuck
Windows	Shellcode Collection - (calc)	19 B	SkuLL-HacKeR
Windows	null-free 32-bit Windows download and LoadLibrary shellcode	164 B	SkyLined
Windows	null-free 32-bit Windows shellcode that executes calc.exe	100 B	SkyLined
Windows	null-free 32-bit Windows shellcode that shows a message box	140 B	SkyLined
Windows	null-free bindshell for Windows 5.0-6.0 all service packs	—	SkyLined
Windows	XP sp2 (FR) Sellcode cmd.exe	32 B	Stack
Windows	XP/sp2 (EN) cmd.exe	23 B	Stack
Windows	XP Professional SP2 ita calc.exe	36 B	Stoke
Windows	WinExec() Command Parameter	104 B	Weiss
Windows	download and execute	124 B	Weiss
Windows	Download and Execute Shellcode Generator	—	YAG KOHHA
Windows	sp3 (Tr) Add Admin Account Shellcode	127 B	ZoRLu
Windows	sp3 (Tr) MessageBoxA Shellcode	109 B	ZoRLu
Windows	sp3 (Tr) calc.exe Shellcode	53 B	ZoRLu
Windows	sp3 (Tr) cmd.exe Shellcode	42 B	ZoRLu
Windows	sp3 (Tr) cmd.exe Shellcode	52 B	ZoRLu
Windows	Xp Pro SP3 Fr (calc.exe)	31 B	agix
Windows	XP PRO SP3 - Full ROP calc shellcode	—	b33f
Windows	xp pro sp3 (calc)	57 B	cr4wl3r
Windows	win32/xp pro sp3 MessageBox shellcode	11 B	d3c0der
Windows	download & exec shellcode - 226 bytes+	—	darkeagle
Windows	Shellcode Checksum Routine	—	dijital1
Windows	IsDebuggerPresent ShellCode (NT/XP)	39 B	ex-pb
Windows	PEB method (9x/NT/2k/XP)	29 B	loco
Windows	connectback, receive, save and execute shellcode	—	loco
Windows	Bind Shell (NT/XP/2000/2003)	356 B	metasploit
Windows	Create Admin User Account (NT/XP/2000)	304 B	metasploit
Windows	Vampiric Import Reverse Connect	179 B	metasploit
Windows	PEB method (9x/NT/2k/XP)	—	oc192
Windows	eggsearch shellcode	33 B	oxff
Windows	XP-sp1 portshell on port 58821	116 B	silicon
Windows	XP SP3 addFirewallRule	—	sinn3r
Windows	PEB method (9x/NT/2k/XP)	31 B	twoci
Windows	Beep Shellcode (SP1/SP2)	35 B	xnull