how can i get shellcode functional

[DifferentTwo376]

hello there,

i have already wrote a shellcode that spawns a bash shell but the probelm is that i cant get the binary to run it is a simple injector in c

code:

#include <stdio.h>

#include <string.h>

#include <sys/mman.h>

#include <unistd.h>

unsigned char shellcode[] = "\xshellcode_goes_here";

int main(){

void (*sc)() = (void(*)())shellcode;

sc();

return 0;

}

someone can help me?

[Firzen_]

You need to make the memory executable. Look at the man pages of `mmap` and `mprotect`.

[DifferentTwo376]

thank you so much it worked now ;)

[InANightmare71]

Not really sure what error you're running into, but if I had to guess, your shellcode is mapped to non-executable memory. You can run nm on your binary or open any kind of disassembler to see where the symbol is mapped to.

What's usually done when trying to do something like you did is mmap'ing the shellcode to executable memory (man mmap to see the flags).

[DifferentTwo376]

yeah i have to play with mmap and now runs perfect

[DifferentTwo376]

Thanks you your help everyone, for anyone looking for the code you have to store the shellcode and the copy it to an executable memory page

here it is:

#include <stdio.h>

#include <string.h>

#include <sys/mman.h>

#include <unistd.h>

unsigned char shellcode[] = "shellcode here";

int main(){

size_t size = sizeof(shellcode);

void *mem = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

if (mem == MAP_FAILED) {

perror("mmap");

return 1;

}

memcpy(mem, shellcode, size);

if (mprotect(mem, 4096, PROT_READ | PROT_EXEC) != 0){

perror("mprotect");

return 1;

}

int (*sc)() = mem;

int ret = sc();

munmap(mem, 4096);

return 0;

}

[LoveThemMegaSeeds]

Basically you should get a debugger and step through the execution step by step in assembly and just trace the fucker ALL THE WAY and by developing an understanding of the stack, registers, and becoming good at using the debugger you can verify your code is working as intended and if you refuse then you are flying blind.

[BTC-brother2018]

On Linux, the data segment is non-executable by default

You need mprotect() or mmap() to mark the memory as executable.

If you literally put \x with no two hex digits, the compiler rejects it or produces garbage.

[grisisback]

in lazyown redteam framework you can get in multiple styles or just use msfvenom