SHELLCODE - Hacking: The Art of Exploitation - page 288

mov edx, 15 ; Length of the string
int 0x80 ; Do syscall: write(1, string, 14)
; void _exit(int status);
mov eax, 1 ; Exit syscall #
mov ebx, 0 ; Status = 0
int 0x80 ; Do syscall: exit(0)
The call instruction jumps execution down below the string. This also
pushes the address of the next instruction to the stack, the next instruction
in our case being the beginning of the string. The return address can imme-
diately be popped from the stack into the appropriate register. Without using
any memory segments, these raw instructions, injected into an existing process,
will execute in a completely position-independent way. This means that, when
these instructions are assembled, they cannot be linked into an executable.
reader@hacking:~/booksrc $ nasm helloworld1.s
reader@hacking:~/booksrc $ ls -l helloworld1
-rw-r--r-- 1 reader reader 50 2007-10-26 08:30 helloworld1
reader@hacking:~/booksrc $ hexdump -C helloworld1
00000000 e8 0f 00 00 00 48 65 6c 6c 6f 2c 20 77 6f 72 6c |.....Hello, worl|
00000010 64 21 0a 0d 59 b8 04 00 00 00 bb 01 00 00 00 ba |d!..Y...........|
00000020 0f 00 00 00 cd 80 b8 01 00 00 00 bb 00 00 00 00 |................|
00000030 cd 80 |..|
00000032
reader@hacking:~/booksrc $ ndisasm -b32 helloworld1
00000000 E80F000000 call 0x14
00000005 48 dec eax
00000006 656C gs insb
00000008 6C insb
00000009 6F outsd
0000000A 2C20 sub al,0x20
0000000C 776F ja 0x7d
0000000E 726C jc 0x7c
00000010 64210A and [fs:edx],ecx
00000013 0D59B80400 or eax,0x4b859
00000018 0000 add [eax],al
0000001A BB01000000 mov ebx,0x1
0000001F BA0F000000 mov edx,0xf
00000024 CD80 int 0x80
00000026 B801000000 mov eax,0x1
0000002B BB00000000 mov ebx,0x0
00000030 CD80 int 0x80
reader@hacking:~/booksrc $
The nasm assembler converts assembly language into machine code and
a corresponding tool called ndisasm converts machine code into assembly.
These tools are used above to show the relationship between the machine
code bytes and the assembly instructions. The disassembly instructions marked
in bold are the bytes of the "Hello, world!" string interpreted as instructions.
Now, if we can inject this shellcode into a program and redirect EIP, the
program will print out Hello, world! Let's use the familiar exploit target of the
notesearch program.