Buffer overflow, SIGV fault at wrong address

Question

I'm trying to understand why my buffer overflow will not work. I've been strugling with this for a few days now, so thought it was about time to ask professionals. I've only recent began to understand the concept of buffer overflow attacks with a NOP sled.

This is for a challange. No spoilers please, but helpfull pointers will be greatly appreciated.

My problem is this:

I am able to run a Perl command like this NOP ... Shellcode ... *mempntr this works like expected when I give it an arbritary pointer.

• Where the blue stuff are my NOP's
• The Red is my shellcode
• The highlighted yellow is my mempntr

---

Program received signal SIGSEGV, Segmentation fault.
0xaaaaaaaa in ?? ()

That is also as expected.

Try with correct mempntr

Now when I try to change the mempntr to something I want to point it at, like halfway through the NOP sled, for instance the location 0xffffd580 things behave weirdly.

At the breakpoint at leave I verify the saved eip

(gdb) i f
Stack level 0, frame at 0xffffd5c0:
eip = 0x80484b1 in main; saved eip = 0xffffd580
Arglist at 0xffffd5b8, args:
Locals at 0xffffd5b8, Previous frame's sp is 0xffffd5c0
Saved registers:
ebp at 0xffffd5b8, eip at 0xffffd5bc

Yet when I c or continue I have a SEGFUALT at a weird location.

Program received signal SIGSEGV, Segmentation fault.
0xffffd5a7 in ?? ()

I'm looking for an answer that could shed some light on this, or point me to a resource where I can learn what is happening.

Answer 1

That location is not weird, it's right in the middle of your shellcode. First verify that your shellcode is not broken. The disassembly of that code reveals this:

0x00000000: push 0xb
0x00000002: pop eax
0x00000003: cdq 
0x00000004: push edx
0x00000005: push 0x702d
0x00000009: mov ecx, esp
0x0000000b: push edx
0x0000000c: push 0x68
0x0000000e: das 
0x0000000f: bound esp, qword ptr [ecx + 0x73]
0x00000012: push 0x6e69622f
0x00000017: mov dword ptr [ebp + 0x33], esp
0x0000001a: push edx
0x0000001b: push ecx
0x0000001c: push ebx
0x0000001d: mov ecx, esp
0x0000001f: int 0x80

Are you sure this is what you really want to achieve with your shellcode?

Secondly, make sure any instruction of your shellcode is not overwriting parts of itself. If the stack pointer is right after your shellcode, push instructions might clobber it from its tail, leaving invalid instructions to execute.