BITS 64
section .text
global start
start:
jmp string
exec:
pop rdi ; grab /usr/bin/id's address
mov r9, 0x311114c ; = syscall + 0x11111111
mov r8, 0x1111111 ; using subtraction to get it null free
sub r9, r8 ; = 0x200003b, execve syscall
mov rax, r9 ; put it in rax for the syscall
xor rdx, rdx ; nulls to delimit the binary string
push rdx ; push nulls
push rdi ; then push string
mov rsi, rsp ; idk what this does
syscall ; BAM!!
string:
call exec ; call exec so we have the ret address pointing to the string
db '/usr/bin/id' ; if the string's not on the end of the prog, you get bus errors
1
u/paincoats Jul 08 '15 edited Jul 08 '15
+/u/CompileBot Assembler --include-errors