9
votes
Accepted
Heap Chunk Structure Does Not Contain Previous Section Info
The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free.
This image is more appropriate of what an allocated heap ...
- 6,110
9
votes
Accepted
Shellcode challenge - shellcode works in test program, segfaults in actual binary
It looks like you have two issues.
1) You are overwriting your input buffer with those push-es so that why you have some junk on the stack and that's why our application crashes.
See those two ...
- 4,952
6
votes
Accepted
ASM working as is, but not in a C program
The problem with you shellcode and the why it differs if you run from C program or not is the initial values.
The registers that are used when executing execv (second page) are:
eax = 0x0b
ebx = ptr ...
- 4,952
5
votes
Accepted
alphanumeric shellcode
Alphanumeric shellcode expects the location of the shellcode to be stored in a register, since the usual technique of call/pop can't be performed with the limited character set.
In your example above ...
- 258
5
votes
Accepted
x86-64 CALL opcode + disassembly
relative address can be forward or backward from end of current instruction
or start of next instruction
that e8 00 00 00 00 will be call to the next immediate instruction
forward can be e8 ( ...
- 16.7k
5
votes
Accepted
Shellcode not working correctly
You're showing x86 (32bit) shellcode, but are not compiling your program for that architecture, so gcc most likely creates an amd64 (64bit) executable instead. This can be fixed by adding the -m32 ...
- 166
4
votes
A buffer overflow exercise using a shellcode
Okay, so I will try to answer to all your questions and add a few remarks.
Do not disable ASLR system-wide, prefer to disable it within the current process.
In fact, echoing 0 in randomize_va_space ...
- 19.2k
4
votes
Accepted
WinDBG Hung on Shellcode Execution
can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ?
if that is the case then it means you allocate memory etc ...
- 16.7k
4
votes
How to load shellcode into Ghidra
Compile and load:
#include <stdio.h>
char shellcode[] =
"\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\x00\x00\x00"
"\x48\x8D\x0D\x52\x00\x00\x00\xE8\x9E\x00\...
- 175
4
votes
Accepted
How to load shellcode into Ghidra
you have a string you cant load a string as is into a disassembler
you may need to un-escape them into binary
for example
"\x48" is "H"
if you have a compiler compile and call it ...
- 16.7k
3
votes
Accepted
how to find memory objects using immunity debugger
Put a INT3 (F2) breakpoint on the recv function (To jump to that function, hit CTRL+G then type recv to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the ...
- 2,038
3
votes
Meaning of code used to find kernel32.dll in shellcode
In WinDbg:
0:000> dt ntdll!_TEB -y ProcessEnvironmentBlock->Ldr->InM
+0x030 ProcessEnvironmentBlock :
+0x00c Ldr :
+0x014 ...
- 16.7k
3
votes
Accepted
Working Linux assembly XOR Encoder/Decoder Failing on Windows
There are few issues with your code.
1st is what Igor mentioned - .text section is RO. This was solved in this answer.
The 2nd is that you did not copy correctly the bytes or lost some of them in ...
- 4,952
3
votes
Accepted
Basic shellcode doesn't work when read from stdin
With the shellcode given I was not able to get a shell. If you strace the binary when getting input from the stack
execve("/bin//sh", ["/bin//sh"], [/* 0 vars */]) = -1 EFAULT (Bad address)
char *...
- 2,739
3
votes
Accepted
Buffer overflow on server
We have two major stack protection for buffer overflows:
Stack canaries
Non-executable stack
You land on nopsled but, you get segmentation fault. Because your operating system marked program stack ...
3
votes
ASM working as is, but not in a C program
Okay, so according to gdb the shellcode does run, so it's probably placed into .text. You should try to step through the shellcode (e.g. using stepi) to see on what instruction it faults.
- 36.9k
3
votes
Accepted
x86 shellcode leads to segmentation fault
Wrong Parameters
I was able to solve my problem!
The function execve has the following definition:
int execve(const char *filename, char *const argv[], char *const envp[]);`
^ ...
- 161
3
votes
ShellCode not running as expected - showing segmentation fault core dump
The argument -z execstack only allows stack to execute code, but the code is a global variable, which is not on stack, so you can do some simple changes to make your code work.
For example,
#include &...
- 31
3
votes
x64 buffer overflow - tcp shell payload
process 6540 is executing new program: /bin/dash
Error in re-setting breakpoint 1: No symbol table is loaded. Use the "file" command.
That's not an error you need to worry about, it likely ...
- 619
2
votes
Accepted
Reverse a BFLT file
bFLT format is used in uCLinux systems and its executables use one of two approaches to make system calls:
Statically linked libc (uClibc). In this case you should see explicit syscalls (SVC ...
- 36.9k
2
votes
Accepted
How to Make .text Section in Assembly Writeable for Win7-64 EXE
I don't see that option in golink linker but if you use i.e. link.exe (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use /SECTION parameter to specify that.
link /SUBSYSTEM:...
- 4,952
2
votes
Working Linux assembly XOR Encoder/Decoder Failing on Windows
I think the problem is that the executable code is not writeable by default on Windows, so it fails when xor tries to modify the code. You should look into how to modify .text section permissions, ...
- 36.9k
2
votes
Accepted
Debugging EXE File in Windbg and How to set Breakpoints in Assembly
It seems bp $exentry should set breakpoint on the entrypoint, then you can continue (g) until you hit it.
- 36.9k
2
votes
Accepted
How to find a fuction hash when manually resolving in shellcode?
iirc you cant go from a constant hash to name
but hash an exported name compare the generated hash with the constant
you can see a discussion and an implementation here
a ripped python ...
- 16.7k
2
votes
Accepted
Why do we need to know the address of shellcode?
Exploiting a software by injecting a shellcode in its memory always requires the following steps:
Have a way to inject your shellcode in memory (usually, it can take place in any buffer of the ...
- 19.2k
2
votes
Accepted
segmentation fault at `mov byte [esi+7], al`
The instruction that causes the SIGSEGV is trying to store a '\0' after the 'h' in "/bin/shJAAAABBBB".
All your code/data is in the .text section which is probably read-only.
Run objdump -h on the ...
- 931
2
votes
Accepted
Why can I inherit handles from WSASocketA and not from socket?
Windows socket() creates a socket with WSA_FLAG_OVERLAPPED flag set and inheritable by default.
Windows WSASocket() allows you to specify WSA_FLAG_OVERLAPPED and WSA_FLAG_NO_HANDLE_INHERIT. If you ...
- 136
2
votes
Accepted
How can I get my shellcode to work outside of GDB?
I don't think your shell code works even in gdb. The problem is in the address of the string in your shellcode. You are not showing in your question how did you get the address of the string that you ...
- 4,952
2
votes
Accepted
How to extract port number from shellcode
The connect syscall takes a sockaddr structure as an argument, which looks something like this:
struct sockaddr_in {
short sin_family;
u_short sin_port;
struct in_addr ...
- 386
Only top scored, non community-wiki answers of a minimum length are eligible