rapid7/metasploit-framework — pull request #3017 by BorjaMerino (2014-02-20 15:23:46+00:00)
Title: hidden single bind shell payload

This is another alternative to the acl_bind_shell (https://github.com/rapid7/metasploit-framework/pull/2981). In this case, the shellcode will answer with a RST packet to any connection attempt started from an IP different than the one you set with AHOST; so the socket will appear as "closed". This is a good way to keep your shellcode hidden from scanning tools (in win XP even from netstat -an)

I've used the setsockopt() API with SO_CONDITIONAL_ACCEPT and wsaccept() to allow the shellcode approve the connection based on the source address.

I used the shell_bind_tcp of Stephen Fewer to add such functionality. This will mean an increasee of 54 bytes (34 more than the ACL bind shell). Any shellcode optimization is welcome.

Here a simple demo video:
http://www.youtube.com/watch?v=xYBuaVNQjGA&hd=1