I am currently reading the book Shellcoder's Handbook of Wiley, and I'm having a very grave problem implementing one of the shell spawning shellcodes from chapter 3. The code is as follows:
jmp short GotoCall
xor eax, eax
mov byte [esi + 7], al
lea ebx, [esi]
mov long [esi + 8], ebx
mov long [esi + 12], eax
mov byte al, 0x0b
mov ebx, esi
lea ecx, [esi + 8]
lea edx, [esi + 12]
To compile(on a 32bit machine), I use:
$nasm -f elf32 -o shellcode.o shellcode.asm
$ld -o shellcode shellcode.o
But when I execute the binary I get a segfault at shellcode+3. I stepped through the executable in IDA with little luck. After executing
mov byte [esp+7],al The program throws an exception segmentation violation with error code 11. I change the EIP to not execute the instruction, and continue, but as soon as
mov long [esi+8],ebx I again get a segfault.
- Why is the program segfaulting? This is a plain ASCII text so the offset has to be correct.
- I tried using other registers too but with little luck.
- I tried the above exploit on Fedora, Kali 2.0 and Ubuntu 14 and a few not so popular Linux variants (all 32 bit). All throw the same error. I disabled ASLR on all of them.
I'd be glad to get around this. Thanks in advance.