Advertisement
Guest User

Untitled

a guest
May 14th, 2013
85
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. [bits 32]
  2. ; Clear registers
  3. xor ebx, ebx
  4. mul ebx
  5.  
  6. ; Prepare registers to call sys_write
  7. mov al, 4
  8. mov dl, 13
  9. ; Push null terminated string 'hello, world\n'
  10. push ebx
  11. push byte `\n`
  12. push `orld`
  13. push `o, w`
  14. push `hell`
  15. ; To write to stdout, uncomment line below.
  16. ; Otherwise output is written to stdin.
  17. ; This still prints, as the file descriptors appear to share a buffer.
  18. ; Omitting this increment saves us 1 byte.
  19. ;inc ebx
  20. ; Set ecx to &string and call sys_write
  21. mov ecx, esp
  22. int 0x80
  23.  
  24. ; Clear edx, set eax to call sys_execve
  25. cdq
  26. mov al, 0xb
  27.  
  28. ; Push null terminated string '-u' and set ecx to its address.
  29. push edx
  30. push word `-u`
  31. mov ecx, esp
  32. ; Push *argv[] to the stack. argv[0] is just '-u' now, as it's not used.
  33. push edx
  34. push ecx
  35. push ecx
  36. mov ecx, esp
  37.  
  38. ; Push path to bin to the stack and make ebx point to it
  39. push edx
  40. push `//id`
  41. push `/bin`
  42. push `/usr`
  43. mov ebx, esp
  44.  
  45. ; Call sys_execve
  46. int 0x80
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement