Assembly- Using push and ESP-Register to store addresses

Question

I have found the following assembly lines presented in a tutorial which I do not understand:

 xor eax, eax      => clear, I know that, it makes eax = 0
 push eax          => push 0 on the stack
 push 0x68732f2f   => push "//sh" to the stack (the numbers are opcodes I guess, output of hexdump)
 push 0x6e69622f   => push "/bin" to the stack (again opcodes, representing "/bin" )
 mov ebx, esp      => put address of "/bin//sh\0" into ebx, via esp
 ....

My question: Why we put address of "/bin//sh" into ebx, via esp using the line mov ebx, esp for that ?

I draw a sketch:

         |                        |
         |------------------------|<-----ESP (I know that ESP always points to the top)
(a)      |  0x6e69622f  ("//sh")  |
         |------------------------|
(b)      |   0x68732f2f ("/bin")  |
         |------------------------|
(c)      |       0                |
         |------------------------|

How I try to explain it to myself(I am not sure if it is correct, but I thought to think about a little bit before I ask in that forum here):

ESP is a 32-bit register such that it is large enough to comprise the addresses at (a), (b) and (c) (which I marked above).

Is that right? I hope somebody can help me?

best regards,

Answer 1

First of all, let me clarify this:

ESP is a 32-bit register which contains a pointer to the stack. It is not, by any means, big enough to comprise the addresses at [...]. It is just pointing at a memory location which holds a, b, and c.

---

What your exploit does is push a string to the stack. Look at the /bin//sh hexadecimal representation:

2f 62 69 6e 2f 2f 73 68

And now look at your assembly:

push 0x68732f2f
push 0x6e69622f

This is not any kind of opcodes, but rather the ASCII representation of the string, pushed as double words (basically, pushes the string in less instructions)

An alternative way would be:

push '/' ; same as push 0x2f
push 'b' ; same as push 0x62
push 'i' ; same as push 0x69
push 'n' ; same as push 0x6e
push '/' ; same as push 0x2f
push '/' ; same as push 0x2f
push 's' ; same as push 0x73
push 'h' ; same as push 0x68

Basically, it's doing the same as above, just in less instructions, by combining the ASCII codes together: 6e69622f instead of 2f, 62, 69, 6e separated. It's also pushing a 0, which is a terminator for a C-style string, so that the string ends there.

Now, the stack has /bin//sh, and all you gotta do is call sys_execve, by doing an int 0x80 (interrupt), which is the way Linux uses to make syscalls.

Since the syscall ID for sys_execve is 11, you move 11 to al (lower part of eax), and put the first argument into ebx, which is a pointer to a string. And since ESP is pointing to the top of the stack, and the top of the stack contains the /bin//sh we pushed before, the exploit assembly means this:

sys_execve("/bin//sh");

There you go, exploited! :)

Answer 2

Its just a technique to embed strings in the exploit, as u can define them in a regular fashion, as u need their address to access them but in an exploit these addresses are dynamic not static or constants.