segmentation fault while running shellcode

Question

I am experimenting with shellcode before digging deep into it so I came across an example from the shellcoders handbook. The example is the following:

char shellcode[] = "\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e\x89\x5e\x08\x89\x4
\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1\xff\xff\xff\x2f\x62\x69
\x6e\x2f\x73\x68";

int main() {

int *ret;
ret = (int *)&ret + 2;
(*ret) = (int)shellcode;
}

the shellcode is supposed to spawn a shell. However I get a segmentation fault error. I compiled the program using gcc compiler with -fno-stack-protector and -z execstack options. I took a quick look at the readelf command and it was clear that the stack is executable

 GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x4

Backticks are used to quote code, not to add emphasis.

Pascal Cuoq
– Pascal Cuoq

2014-10-31 09:32:41 +00:00
Commented Oct 31, 2014 at 9:32 — Pascal Cuoq
– Pascal Cuoq, Commented Oct 31, 2014 at 9:32

Gopi · Accepted Answer · 2014-10-31 09:28:25Z

2

ret is a pointer and it not pointing to any memory location when you declare it. Later you are trying to assign some value to it by adding 2 to the location the pointer is pointing to.(Which is contradictory statement )

ret = (int *)&ret + 2;/* Which is wrong */

answered Oct 31, 2014 at 9:28

Gopi

19.9k4 gold badges28 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

T-D Over a year ago

True. Its clear now. Thats why you always need someone else to read what you write, because he will simply see your mistakes that you just overlook every time you re-read the code.

Stack Exchange Broke The Law Over a year ago

I downvoted this answer. The question's code is intended overwrite the return address with the address of shellcode; it is not accidental undefined behaviour. (And obviously it's not supposed to be portable or standard-conforming C)

T-D Over a year ago

@immibis would you like to answer the question then ?

Gopi Over a year ago

@T-D We can't convince everyone I hope I answered your question :)

Akatsuki · Accepted Answer · 2014-10-31 11:13:19Z

0

I compile following code using "gcc filename.cpp" command. Ti's compiled without error.I hope this will help you to solve your doubt.

#include<stdio.h>

char shellcode[] = "\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e\x89\x5e\x08\x89\x4\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";

int main() {

int *ret;
ret = (int *) ret + 2; //I don't know why you had written this
ret = (int *)shellcode;

}

edited Oct 31, 2014 at 11:13

answered Oct 31, 2014 at 10:11

Akatsuki

2821 silver badge12 bronze badges

Collectives™ on Stack Overflow

segmentation fault while running shellcode

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related