Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ##
- # shell1_32.s - Executes a shell by calling execve
- # Compile and Link:
- # gcc -m32 -c shell1_32.s
- # ld -o shell1_32 -melf_i386 shell1_32.o
- # Starts the data section, this is where the program stores initialized
- # variables, and it is in a separate memory space than the .text section
- .data
- # This is the location of the program we intend to execute
- shell_name:
- .asciz "/bin/sh"
- # This is an argument we intend to pass to /bin/sh
- shell_arg:
- .asciz "-p"
- # This starts the .text section of the code, or the code section
- .text
- .global _start
- _start:
- # function prolog
- push %ebp
- mov %esp, %ebp
- # places a NULL pointer on the stack
- xor %edi, %edi
- push %edi
- # place a pointer to "/bin/sh" on the stack
- mov $shell_arg, %edi
- push %edi
- # place a pointer to the argument "-p" on the stack
- mov $shell_name, %edi
- push %edi
- # move the pointer to "/bin/sh" into %ebx (the first argument to execve)
- mov %edi, %ebx
- # move a pointer to the argv list into %ecx
- mov %esp, %ecx
- # make the envp pointer NULL
- xor %edx, %edx
- # place 11 (execve systemcall number) into %eax
- xor %eax, %eax
- mov $0xb, %eax
- # make the system call
- int $0x80
- # function epilog
- pop %ebp
- ret
Add Comment
Please, Sign In to add comment