|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
.section __TEXT,__text .globl _main .p2align 2 _main: // 1. Construir / bin/sh en el Stack sub sp, sp, #16 mov x0, #0x622f // "/b" movk x0, #0x6e69, lsl #16 // "in" movk x0, #0x732f, lsl #32 // "/s" movk x0, #0x68, lsl #48 // "h" + \0 str x0, [sp] // 2. Preparar registros para execve mov x0, sp // X0 -> bin/sh sub sp, sp, #16 // Crear array argv str x0, [sp] // argv[0] = path str xzr, [sp, #8] // argv[1] = NULL mov x1, sp // X1 -> argv mov x2, xzr // X2 = envp = NULL // 3. Syscall execve (0x200003B) mov x16, #0x3b movk x16, #0x0200, lsl #16 svc #0x80 |