Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In doing a university assignment, we are launching a shell on a remote server. That's all fine, I have connect back shell code, and when I hardcode the hex attack string into the server and jump to it, it launches. (The stack is executable, so that's not the issue (though it was for a while!))

However, when I pass it (packed using Perl) over the TCP connection, it only executes part of the way. Using gdb, I was able to determine that it set up the socket and connection, but segfaulted at the point it was pushing "/bin/sh" to the stack, specifically, on hitting a \x89 (mov ebx, esp).

Any ideas as to what is happening here?

Thanks!

share|improve this question
    
Glad to hear you got it working, can you comment the other question with what the problem was? Also - this is where you realise that you pretty much have to write your own shellcode, I've never had any luck with out-of-the-box shellcode, it's always really architecture specific and will usually segfault in my experience. –  lynks Dec 11 '12 at 10:38
    
The previous one was an error on the part of the prof. The stack wasn't executable after all (although it was supposed to be)! I feel hours of fun are in my imminent future... –  Richard Dec 11 '12 at 14:36
add comment

1 Answer

This isn't really a security question, it's a low-level architecture one. But to get you started, I'd suggest looking in to what a Segmentation Fault actually represents.

Specifically, it happens on an attempt to read or write on a memory address to which the process does not access. The act of copying one register to another does not access memory, so it shouldn't be capable of triggering a segfault. Make sure you're actually performing the operation you think you are. Make sure that the issue isn't actually the previous or next instruction. Finally, another option is look at the location in memory of the EIP. It's probably not the problem, but it may be worth checking what memory is accessed as a side-effect of what's going on.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.