I wrote a program in C that is exploitable to BOF.
TL;DR - My payload (NOP-sled + shellcode + return address) overrides EIP but I can't set EIP to point to the address of my payload, although I can set EIP to be anywhere else outside the Stack adress-range. Stack seems to be executable and the proections I familiar with are off.
I sent a payload using
ragg2 De bruijin pattern, and found the offset that overrides EIP. I then created a payload with NOP-sled, then shellcode, and at the offset that overrides EIP I wrote the address of the middle of my NOP-sled.
So the payload looked something like this:
NOP-sled + Shellcode + Address somewhere at the middle of my NOP-Sled (Little Endian).
Something strange happened and I wasn't able to exploit the program: after the segfault, EIP wasn't at the address I used at the end of my payload, EIP was like 600 addresses after. But when I changed the address at the end of my payload to something else, like "AABB" (0x42424141), or 0xd4d4fdff (instead of 0xd4d4ffff that is an address at the middle of my shellcode, little-endian) it worked just fine and EIP was at the address I supplied.
nx protection is off,
ASLR is disabled,
Selinux disabled, the memory page seems to be executable and the ELF compiled using
"-fno-stack-protector -z execstack" on GCC.
Tried it also on gdb and also outside of any debugger.
what can be the problem? Why it refuses to jump to the address on the stack?
Info about the binary:
havecode true pic false canary false nx false crypto false va true intrp /lib/ld-linux.so.2 bintype elf class ELF32 lang c arch x86 bits 32 machine Intel 80386 os linux minopsz 1 maxopsz 16 pcalign 0 subsys linux endian little stripped false static false linenum true lsyms true relocs true rpath NONE binsz 6162
Info about the stack:
sys 132K 0xfffdd000 - 0xffffe000 s -rwx [stack] [stack] ; map._stack_._rwx
EDIT: You can find more details, including commands and the shellcode itself here: http://pastebin.com/HYbByNSE