Good writeup, not enough people go in depth like this on shellcode!
Metasploit has some decent shellcode. What you wrote here is essentially a specialized execve payload. Some of metasploit's execve payloads support passing arguments to execve, by building the args array on the fly:
Which prevents other IPs from jacking your shells.
EDIT: also I think you need a null byte at the end of everything, otherwise the last arg string might not terminate correctly depending on what's in memory.
Metasploit has some decent shellcode. What you wrote here is essentially a specialized execve payload. Some of metasploit's execve payloads support passing arguments to execve, by building the args array on the fly:
https://github.com/rapid7/metasploit-framework/blob/master/m...
There are also lots of reverse shells like this, and reverse stagers too. Additionally, there are other solutions to bind shells being noisy:
See https://github.com/rapid7/metasploit-framework/pull/3017
Which causes the port to show as "closed" in a scan, and
https://github.com/rapid7/metasploit-framework/pull/2981
Which prevents other IPs from jacking your shells.
EDIT: also I think you need a null byte at the end of everything, otherwise the last arg string might not terminate correctly depending on what's in memory.