I'm trying to write the shellcode for an execve(/bin/sh) but i'm having some trouble understanding why it doesn't work.
here is my .asm code :
global _start
section .text
_start:
; PUSH 0x00000000 on the Stack
xor rax, rax
push rax
; PUSH //bin/sh in reverse i.e. hs/nib//
push 0x68732f6e
push 0x69622f2f
; Make RDI point to //bin/sh on the Stack using RSP
mov rdi, rsp
; PUSH 0x00000000 using RAX and point RDX to it using RSP
push rax
mov rdx, rsp
; PUSH Address of //bin/sh on the Stack and make RSI point to it using RSP
push rdi
mov rsi, rsp
; RAX = 0, Let's move 59 into AL to avoid nulls in the Shellcode
mov al, 0x3b ; SYS_execve
syscall
I use "strace -f -s 10000 -e execve ./shellcode" to see if my execve command is well written, and I got this :
execve("//bi", ["//bi"], [/* 0 vars */]) = -1 ENOENT (No such file or directory)
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xfffffffffffffffe} ---
+++ killed by SIGSEGV +++
Segmentation fault
I don't understand why I have only "//bin" and not the entire string. I tried with longer strings and it is still the same, displaying only 4 char and not working.
Btw, im on x86_64 using nasm, and I don't understand why I can't push 8 bytes, like pushq 0x0000000000000000
(pushq results with a parser error, while using push truncates the input)
User contributions licensed under CC BY-SA 3.0