I am trying to execute a shellcode in the configuration:
- No VA randomization (set to 0)
- Server is listening on port 9000
- Terminal listening with netcast on port 31337
- Server and attacker are the same (virtual) machine, kali linux 2018.4 32-bit
The shellcode aims to do a shell_reverse_tcp. The payload was generated with the linux/x86/shell_reverse_tcp LPORT=31337 LHOST=127.0.0.1 and shikata_ga_nai encoder.
I found saved EIP and sent the payload with a nop sled, the shellcode and the address which is
Running the server with gdb, I see that the address that arrives is
If I put "ABCD" in the address I correctly see the string in hex, but I cannot set the address (which refers to the middle of the nop sled) as it "resets" itself to \xff
Is that a problem due to encoding, or maybe telenet ?
It looks like
0xbfxxxxxx changes to
0xffxxxxxx when the following character is also
f. I don't know why. If I change to something else, it does not change the first two characters to