Shellcode segfaulting

Question

I am currently reading the book Shellcoder's Handbook of Wiley, and I'm having a very grave problem implementing one of the shell spawning shellcodes from chapter 3. The code is as follows:

Section .text global _start _start: jmp short GotoCall shellcode: pop esi xor eax, eax mov byte [esi + 7], al lea ebx, [esi] mov long [esi + 8], ebx mov long [esi + 12], eax mov byte al, 0x0b mov ebx, esi lea ecx, [esi + 8] lea edx, [esi + 12] int 0x80 GotoCall: Call shellcode db ‘/bin/shJAAAAKKKK'

To compile(on a 32bit machine), I use: $nasm -f elf32 -o shellcode.o shellcode.asm $ld -o shellcode shellcode.o But when I execute the binary I get a segfault at shellcode+3. I stepped through the executable in IDA with little luck. After executing mov byte [esp+7],al The program throws an exception segmentation violation with error code 11. I change the EIP to not execute the instruction, and continue, but as soon as mov long [esi+8],ebx I again get a segfault.

1. Why is the program segfaulting? This is a plain ASCII text so the offset has to be correct.
2. I tried using other registers too but with little luck.
3. I tried the above exploit on Fedora, Kali 2.0 and Ubuntu 14 and a few not so popular Linux variants (all 32 bit). All throw the same error. I disabled ASLR on all of them.

I'd be glad to get around this. Thanks in advance.

Answer 1

The shellcode is self-modifying and is thus supposed to reside on the stack (or some other writable region). The following instructions

mov byte [esi + 7], al
mov long [esi + 8], ebx
mov long [esi + 12], eax

are overwriting the JAAAAKKKK bytes at the end, which resides in the .text segment. As .text segment is not writable, your program is throwing a segfault.