Skip to content

Instantly share code, notes, and snippets.

@crowell
Created September 17, 2015 21:01
Show Gist options
  • Save crowell/85e7f648037d5a067f79 to your computer and use it in GitHub Desktop.
Save crowell/85e7f648037d5a067f79 to your computer and use it in GitHub Desktop.
[0x000442b1]> izz~bin/sh
vaddr=0x0018c3dd paddr=0x0018c3dd ordinal=17671 sz=8 len=7 section=.rodata type=ascii string=/bin/sh
[0x000442b1]> axt 0x0018c3dd
d 0x442b1 lea rdi, [rip + 0x148125]
d 0xcb945 lea rsi, [rip + 0xc0a91]
d 0xcb6f1 lea rax, [rip + 0xc0ce5]
d 0xcb9c0 lea rdi, [rip + 0xc0a16]
d 0xff97e lea rax, [rip + 0x8ca58]
d 0x70953 lea rdi, [rip + 0x11ba83]
d 0xcbaa0 lea rdi, [rip + 0xc0936]
d 0xf074c lea rax, [rip + 0x9bc8a]
d 0xf084c lea rdi, [rip + 0x9bb8a]
d 0xf0860 lea rax, [rip + 0x9bb76]
d 0xf158d lea rax, [rip + 0x9ae49]
d 0xf16c2 lea rax, [rip + 0x9ad14]
d 0xf1719 lea rdi, [rip + 0x9acbd]
d 0xf6506 lea rdi, [rip + 0x95ed0]
d 0xf6893 lea rax, [rip + 0x95b43]
d 0xf6950 lea rdi, [rip + 0x95a86]
[0x000442b1]> pd 10 @ 0x442b1
| 0x000442b1 488d3d258114. lea rdi, [rip + 0x148125] ; 0x18c3dd ; str._bin_sh ; "/bin/sh" @ 0x18c3dd
| 0x000442b8 488d742430 lea rsi, [rsp + 0x30] ; 0x30 ; section_end..gnu.warning.fdetach ; section_end..gnu.warning.fdetach
| 0x000442bd c70579233800. mov dword [rip + 0x382379], 0 ; [0x3c6640:4]=0x20646573 ; "sed instead." 0x003c6640 ; "sed instead." @ 0x3c6640
| 0x000442c7 c70573233800. mov dword [rip + 0x382373], 0 ; [0x3c6644:4]=0x74736e69 ; "instead." 0x003c6644 ; "instead." @ 0x3c6644
| 0x000442d1 488b10 mov rdx, qword [rax]
| 0x000442d4 e8676d0800 call sym.execve ;sym.execve()
| 0x000442d9 bf7f000000 mov edi, 0x7f
| 0x000442de e8fd6c0800 call sym._Exit ;sym._Exit() ; sym._exit
| 0x000442e3 0f1f00 nop dword [rax]
| 0x000442e6 662e0f1f8400. nop word cs:[rax + rax]
[0x000442b1]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment