why does the following non stack shellcode load /bin/sh string without pushing it onto the Stack?

Question

the c code:

void overflow (char* inbuf)
{
  char buf[64];

  strcpy(buf, inbuf);
}

int main (int argc, char** argv)
{
    overflow(argv[1]);
    return 0;
}

Answer 1

It actually does. The push operation is performed by the call instruction. This instruction will push the address of the next instruction, here the address is 0x21. From 0x21 to 0x28 you have your /bin/sh string which is, on your case, wrongly disassembled as x86 code. Last but not least, the linux x86 32-bit syscall calling convention doesn't use the stack at all. The parameters are passed through ebx, ecx, edx, esi, edi, ebp and the syscall number is stored in eax.