problem with an execve (/bin/sh) shellcode

0

I'm trying to write the shellcode for an execve(/bin/sh) but i'm having some trouble understanding why it doesn't work.

here is my .asm code :

global _start       

section .text
_start:

    ; PUSH 0x00000000 on the Stack

    xor rax, rax
    push rax

    ; PUSH //bin/sh in reverse i.e. hs/nib//

    push 0x68732f6e
    push 0x69622f2f

    ; Make RDI point to //bin/sh on the Stack using RSP

    mov rdi, rsp

    ; PUSH 0x00000000 using RAX and point RDX to it using RSP

    push rax
    mov rdx, rsp 

    ; PUSH Address of //bin/sh on the Stack and make RSI point to it using RSP

    push rdi
    mov rsi, rsp

    ; RAX = 0, Let's move 59 into AL to avoid nulls in the Shellcode

    mov al, 0x3b        ; SYS_execve
    syscall

I use "strace -f -s 10000 -e execve ./shellcode" to see if my execve command is well written, and I got this :

execve("//bi", ["//bi"], [/* 0 vars */]) = -1 ENOENT (No such file or directory)
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xfffffffffffffffe} ---
+++ killed by SIGSEGV +++
Segmentation fault

I don't understand why I have only "//bin" and not the entire string. I tried with longer strings and it is still the same, displaying only 4 char and not working.

Btw, im on x86_64 using nasm, and I don't understand why I can't push 8 bytes, like pushq 0x0000000000000000 (pushq results with a parser error, while using push truncates the input)

assembly
x86-64
shellcode
execve
asked on Stack Overflow May 23, 2019 by John924734 • edited May 24, 2019 by Peter Cordes

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0