Shellcode techniques

Before we look at the various shellcode techniques within Linux, let's spend some time on system calls (abbreviated as syscalls). Syscalls are the mechanism in which a Linux program calls functions in the kernel. When a program performs a read or a write, it is making use of a syscall, hence syscalls provide an essential interface.

Pro Tip

To view a full list of 64-bit system call numbers, you can run the following command:

cat /usr/include/x86_64-linux-gnu/asm/unistd_64.h

Or if you want to view the 32-bit system call numbers, you can run the following command:

cat /usr/include/x86_64-linux-gnu/asm/unistd_32.h

You can also view this from the tovalds/linux GitHub repository:

https://github.com/torvalds/linux/blob/master/arch/x86/entry/syscalls/syscall_64.tbl

Basic Linux shellcode

To get started with shellcoding in Linux, let's start with the basics. In this section, we will look at shellcode that spawns a bin/bash shell and utilizes...