Why am I getting a segmentation fault? (Testing Shellcode)

Question

I wrote a simple ASM file and ran it in a C file I'd written. I got a segentation fault. However, when I execute the compiled ASM file, I get no error.

I am running 64 bit and using 32 bit shellcode. Is that the issue?

It can't be, because I'm getting a segmentation fault with this:

char shellcode[] = "\x90"; //simple NOP in ASM
int main(int argc, char **argv)
{
  int (*ret)();
  ret = (int (*)()) shellcode;
  (int)(*ret)();
}

Can someone please run this and tell me whether or not they get a segmentation fault. I have used 3 or 4 other C files as well. None have worked.

Update:

((void(*)(void))code)();

Seems to be working in place of those three lines.

That is not how you use inline assembler... first, which compiler are you using? Here is how you do it with "gcc". — Elliott Frisch
– Elliott Frisch, Commented Jan 9, 2014 at 21:12
On what platform (what operating system, what compiler)? It could be because your heap isn't executable. — Gilles 'SO- stop being evil'
– Gilles 'SO- stop being evil', Commented Jan 9, 2014 at 21:17
It's unlikely that an x86-64 OS will let you execute data in any case. — Brett Hale
– Brett Hale, Commented Jan 9, 2014 at 21:25

Ray · Accepted Answer · 2014-09-21 13:25:43Z

12

As mentioned above the shellcode is in non-executable memory. Try recompiling the program with the -fno-stack-protector and the -z execstack flags enabled.

That is:

gcc -fno-stack-protector -z execstack -O OutputFileName yourShellCode.c

answered Sep 21, 2014 at 13:25

Ray

3031 gold badge3 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

WhiteWinterWolf Over a year ago

Alternatively, one can also run execstack OutputFileName on a binary already compiled without these supplementary parameters.

Adam Rosenfield · Accepted Answer · 2014-01-09 21:54:38Z

Two issues:

The shell code might be in non-executable memory. In order to make it executable, you need to either ask the OS to make it executable (e.g. with mprotect(2) or VirtualProtect()), or allocate new executable memory and copy it there (e.g. with mmap(2) or VirtualAlloc().
Your shell code doesn't return/exit. After the CPU executes your NOP there (0x90), it's going to keep on executing code in the memory that comes after that NOP instruction. Most likely, this will crash quickly, but it might do other random, unpredictable things.

To fix #2, you need to explicitly either execute a return instruction (C3 on x86/x86-64) to return from your shell code, or you need to do something which never returns, like call the exit(3) function.

Community · Accepted Answer · 2017-05-23 12:25:25Z

3

Maybe you should change your variable :

   char shellcode[]

To:

   const char shellcode[]

Like in this question: segmentation-fault-error-when-exe-c

This one worked for me! :)

edited May 23, 2017 at 12:25

CommunityBot

11 silver badge

answered May 21, 2015 at 19:39

KimSki

313 bronze badges

1 Comment

Evgeny Danilenko Over a year ago

that did it! OS: Arch Linux x86_64 Kernel Release: 4.9.8-1-ARCH Uptime: 2:41 WM: i3 DE: None Packages: 765 RAM: 2405 MB / 5963 MB Processor Type: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz $EDITOR: None Root: 16G / 69G (23%) (ext4)

Jurakin · Accepted Answer · 2022-03-03 13:36:37Z

2

Try put the shellcode in the main function to make it a local variable:

int main(int argc, char **argv)
{
  const char shellcode[] = "<your shellcode>";
  int (*ret)();
  ret = (int (*)()) shellcode;
  (int)(*ret)();
}

Then compile it with flags -fno-stack-protector and -z execstack:

gcc <filename>.c -fno-stack-protector -z execstack -o <filename>

I found this idea on stackexchange and it worked for me.

edited Mar 3, 2022 at 13:36

answered Mar 3, 2022 at 13:30

Jurakin

1,1711 gold badge10 silver badges22 bronze badges

Collectives™ on Stack Overflow

Why am I getting a segmentation fault? (Testing Shellcode)

4 Answers 4

1 Comment

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related