This blog post describes manual creating of TCP reverse shellcode on Intel 32-bit architecture and Linux platform. If you have already read previous blog post how to create bind shell you will find this post very easy to follow as the progress is almost the same.
We do connect() the socket directly to target IP and port.
Call to connect() initiates a connection on a socket. First argument is file descriptor from socket() call. Second argument is structure with protocol family, port and IP. Note that port and IP are converted into network byte order (big-endian). IP mustn’t contain any zeros otherwise we will end up with null bytes in the shellcode! Third argument is just size of sockaddr_in structure in bytes.
First find out AF_INET and SOCK_STREAM values. It can be discovered by running strace or in http://students.mimuw.edu.pl/SO/Linux/Kod/include/linux/socket.h.html. AF_INET = 2, SOCK_STREAM = 1.
We already know that AF_INET = 2.