0

Full disclosure: I am seeking help to complete a college assignment. I am seeking help on steps where I am stuck and unable to move forward, not a ready made answer.

I need to exploit it to get a shell with the help of a shellcode through buffer overflow. The program has some check to avoid debugging and sort of canary to avoid buffer overflow. When I bypass these two checks, in gdb, I am able to get the shell.

However in the shell the program is exhibiting a behavior that I am not able to understand. When I attempt to pass a long string, instead of generating a segmentation fault the program suspends/stops.

$ ./prog $(python -c 'print "A" * 1000')

[1]+ Stopped ./prog $(python -c 'print "A" * 1000')

Inside gdb, however, the program does generate segmentation fault. Similarly, inside gdb I am able to get a shell but in the shell the program stops/suspends like above. Attempting to bring it to foreground using 'fg' doesn't work and I do not get any respone. I have to kill it from another terminal.

$ file ./prog

prog: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=7bfd429ec2e2d445afeb557b9eead176f3136690, not stripped

The output of ps when the program is stopped both due to my shellcode and by overflow:

$ ps f
PID TTY STAT TIME COMMAND
3776 pts/0 Ss+ 0:39 -bash
17774 pts/0 t 0:00 \_ AAAAAAAAAAAAAAA....
28834 pts/0 t 0:00 \_ /bin//sh

Can someone help me in understanding what syntax I should be looking for in the assembly code of this program to find what is causing the program to suspend? Or anything else I might be missing?

2

A program might act differently in gdb environment and the shell environment, due to the environment variables GDB sets upon execution. GDB sets two environment variables LINES and COLUMNS to show the output on terminal correctly. Use the following commands inside GDB, then run the program inside GDB and adjust the shellcode accordingly.

Unset environment LINES 
Unset environment COLUMNS

Source 1

Source 2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.