First of all, the opcodes that you are pointing are not responsible for the syscall. If you disassemble your shellcode, you get:
0000000000004028 <shellcode>:
4028: bb 00 00 00 00 mov $0x0,%ebx
402d: b8 01 00 00 00 mov $0x1,%eax
4032: cd 80 int $0x80
A first mov
to set ebx
to zero (the return code), then a second mov
to set eax
to the id of the exit
syscall, and finally it trigger the system call.
Second, this shellcode is obviously designed for a 32-bit architecture. And, you have to know that the syscall numbers are different between i386 and amd64.
So, my recommendation would be that you compile your program with the option -m32
to ensure that you have a full 32-bit program (and not a mix between 64-bit and 32-bit).
Third, you need to be sure that you compile with -zexecstack
in order to be able to execute the code in case it is stored on the stack.
Finally, there is no evidence that getting ret + 2
will set your pointer in front of the saved eip
. You'd better write:
int main()
{
char shellcode[] = "\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80";
(*(void(*)()) shellcode)();
return 0;
}