1

I am trying to use an environment variable to store my shellcode and then point my RET to it, so that I may get to execute my shellcode. Here is my vulnerable program 'abc.c'

#include string.h
#include stdio.h

void foo(const char* str){
 char buf[100];
 printf("\n%p\n",buf);
 strcpy(buf,str);
}
int main(int argc, const char* argv[]){

 foo(argv[1]);
}

I've been doing the following steps so far

$gcc -z execstack -fno-stack-protector -o abc abc.c 

Using getenv() inside another program I determined what the address of my shellcode was. Let us say it is some 0xbfffc209

Using $./abc $(python -c 'print "AAAA"*30') crashes my program mercilessly, but if I use an address in place of the four A's my program cleanly exits.

Using A's enter image description here

Now using an address in Intel format enter image description here

As can be seen nothing has been overwritten. The output of ltrace with

$ltrace ./abc $(python -c 'print "\x09\xc2\xff\xbf"*30') and also

$ltrace ./abc $(perl -e 'print "\x09\xc2\xff\xbf"*30') is enter image description here

I'm totally baffled with an inexplicable behavior of this sort, and would be glad if someone can help me figure why this is happening so.

Thanks in advance

PS

  1. I use an Ubuntu 14.04 32 bit VM

  2. I get the same results thrown at me no matter what address I use

  • "\x09" '\t' (horizontal tab) is a bad character for you it seems. Pad your shellcode with a large number of NOP "\x90" bytes and get to an address where no bad characters are present. – sudhackar Dec 21 '17 at 9:42
3

Not every character in your payload can be sent through the argv of your binary. There are some "bad characters" which you can't have in your shellcode. An example is "\x00" as you're using strcpy to copy strings and "\x00" is the delimiter for your strings. So first figure out what are the bad characters for your platform and then make a payload that is free of those bytes.

PS: I could have commented this but I only had 49 reputation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.