rapid7/metasploit-framework — pull request #2350 by geyslan (2013-09-10 22:33:20+00:00)
Title: New Payload (shell_bind_tcp_random_port)

This payload is the tiniest of its kind, because it doesn't bind the socket; it just let the kernel do it, opening a random port. Use nmap to discover the open port: 'nmap -sS target -p-'.

More details: http://www.hackingbits.com/2013/03/hacking-do-dia-shell-bind-tcp-random.html and https://github.com/geyslan/SLAE/blob/master/improvements/tiny_shell_bind_tcp_random_port.asm