I am trying to execute a shellcode in the configuration:

  • No VA randomization (set to 0)
  • Server is listening on port 9000
  • Terminal listening with netcast on port 31337
  • Server and attacker are the same (virtual) machine, kali linux 2018.4 32-bit

The shellcode aims to do a shell_reverse_tcp. The payload was generated with the linux/x86/shell_reverse_tcp LPORT=31337 LHOST= and shikata_ga_nai encoder.

I found saved EIP and sent the payload with a nop sled, the shellcode and the address which is \x70\xee\xff\xbf Running the server with gdb, I see that the address that arrives is \x70\xee\xff\xff

If I put "ABCD" in the address I correctly see the string in hex, but I cannot set the address (which refers to the middle of the nop sled) as it "resets" itself to \xff

Is that a problem due to encoding, or maybe telenet ?

EDIT: It looks like 0xbfxxxxxx changes to 0xffxxxxxx when the following character is also f. I don't know why. If I change to something else, it does not change the first two characters to ff.


The problem cam from telnet.

Telnet transmits \xbf\xff as \xff\xff in the command echo $(python -c 'print "\x90"*300 + "\x77\x77\xff\xbf"') | telnet localhost 7777

Using netcast solved the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.