0

I am trying to execute a shellcode in the configuration:

  • No VA randomization (set to 0)
  • Server is listening on port 9000
  • Terminal listening with netcast on port 31337
  • Server and attacker are the same (virtual) machine, kali linux 2018.4 32-bit

The shellcode aims to do a shell_reverse_tcp. The payload was generated with the linux/x86/shell_reverse_tcp LPORT=31337 LHOST=127.0.0.1 and shikata_ga_nai encoder.

I found saved EIP and sent the payload with a nop sled, the shellcode and the address which is \x70\xee\xff\xbf Running the server with gdb, I see that the address that arrives is \x70\xee\xff\xff

If I put "ABCD" in the address I correctly see the string in hex, but I cannot set the address (which refers to the middle of the nop sled) as it "resets" itself to \xff

Is that a problem due to encoding, or maybe telenet ?

EDIT: It looks like 0xbfxxxxxx changes to 0xffxxxxxx when the following character is also f. I don't know why. If I change to something else, it does not change the first two characters to ff.

Improve this question

1 Answer 1

Reset to default
0

The problem cam from telnet.

Telnet transmits \xbf\xff as \xff\xff in the command echo $(python -c 'print "\x90"*300 + "\x77\x77\xff\xbf"') | telnet localhost 7777

Using netcast solved the issue.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .