0

In doing a university assignment, we are launching a shell on a remote server. That's all fine, I have connect back shell code, and when I hardcode the hex attack string into the server and jump to it, it launches. (The stack is executable, so that's not the issue (though it was for a while!))

However, when I pass it (packed using Perl) over the TCP connection, it only executes part of the way. Using gdb, I was able to determine that it set up the socket and connection, but segfaulted at the point it was pushing "/bin/sh" to the stack, specifically, on hitting a \x89 (mov ebx, esp).

Any ideas as to what is happening here?

Thanks!

Improve this question
3
  • Glad to hear you got it working, can you comment the other question with what the problem was? Also - this is where you realise that you pretty much have to write your own shellcode, I've never had any luck with out-of-the-box shellcode, it's always really architecture specific and will usually segfault in my experience.
    – lynks
    Dec 11, 2012 at 10:38
  • The previous one was an error on the part of the prof. The stack wasn't executable after all (although it was supposed to be)! I feel hours of fun are in my imminent future...
    – Richard
    Dec 11, 2012 at 14:36
  • This seems like something better suited for stackoverflow.com
    – motoku
    May 3, 2018 at 23:09

1 Answer 1

Reset to default
3

This isn't really a security question, it's a low-level architecture one. But to get you started, I'd suggest looking in to what a Segmentation Fault actually represents.

Specifically, it happens on an attempt to read or write on a memory address to which the process does not access. The act of copying one register to another does not access memory, so it shouldn't be capable of triggering a segfault. Make sure you're actually performing the operation you think you are. Make sure that the issue isn't actually the previous or next instruction. Finally, another option is look at the location in memory of the EIP. It's probably not the problem, but it may be worth checking what memory is accessed as a side-effect of what's going on.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .