In doing a university assignment, we are launching a shell on a remote server. That's all fine, I have connect back shell code, and when I hardcode the hex attack string into the server and jump to it, it launches. (The stack is executable, so that's not the issue (though it was for a while!))

However, when I pass it (packed using Perl) over the TCP connection, it only executes part of the way. Using gdb, I was able to determine that it set up the socket and connection, but segfaulted at the point it was pushing "/bin/sh" to the stack, specifically, on hitting a \x89 (mov ebx, esp).

Any ideas as to what is happening here?


  • Glad to hear you got it working, can you comment the other question with what the problem was? Also - this is where you realise that you pretty much have to write your own shellcode, I've never had any luck with out-of-the-box shellcode, it's always really architecture specific and will usually segfault in my experience. – lynks Dec 11 '12 at 10:38
  • The previous one was an error on the part of the prof. The stack wasn't executable after all (although it was supposed to be)! I feel hours of fun are in my imminent future... – Richard Dec 11 '12 at 14:36
  • This seems like something better suited for stackoverflow.com – motoku May 3 '18 at 23:09

This isn't really a security question, it's a low-level architecture one. But to get you started, I'd suggest looking in to what a Segmentation Fault actually represents.

Specifically, it happens on an attempt to read or write on a memory address to which the process does not access. The act of copying one register to another does not access memory, so it shouldn't be capable of triggering a segfault. Make sure you're actually performing the operation you think you are. Make sure that the issue isn't actually the previous or next instruction. Finally, another option is look at the location in memory of the EIP. It's probably not the problem, but it may be worth checking what memory is accessed as a side-effect of what's going on.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.