Working on a CTF challenge and the coordinators hint suggests that one of the vectors to inject shellcode is via pathing. Looking at debugging prints does show the cwd and filename are passed onto the stack and a quick test shows creating a symlink and using that the pathing is reflected on the stack. I took a shellcode template produced by pwntools, stored it in a bytestring and created both a file and directory containing the bytestrings.This is what I'm seeing, one contains NOPs pre-appended the other just the shellcode.
Inspecting the stack, I'm seeing that each char is encoded into ASCII so "90" becomes 3930. I'm a bit lost as to how I can preserve the bytestring or encode this first so that when it's read in as a string it can interpreted as the correct bytes. Any suggestions would be very welcome!
Here's what I am working with, new to pwntools but this is my bytestring that I'm trying to inject into a filename. The last entry shows what I'm seeing reflected in memory when inspecting the directory or symlink execution shown above.
Here's what I'm seeing in GDB where the filename gets read in as a string:
Finally, here's what I see when inspecting the hex contents of these addresses, we see the ASCII values for each char in the string.