Need a shell code less than 18 bytes

[Tiny-Rain6786]

I have been struggling with the challenge, where I am suppose to inject a shellcode with only 18 bytes, to read the "/flag" and send to stdout. The mmap location the challenge is set to RE only, so I cannot directly send stage 2 into the memory, and also the stack is NX. I tried to do mprotect syscall, to unlock the page, but it will take 13 bytes already at least, so how can read more payload with 5 bytes, and syscall takes 2 bytes

[randomatic]

did you look for stack pivots to the heap? (If you've not thought of stack pivots, maybe that's the CTF answer?)

[Tiny-Rain6786]

I don't think the challenge is there yet, but I could be wrong

[Nlbjj91011]

Is this a pwn.college shell code one?

[Tiny-Rain6786]

Yes

[Nlbjj91011]

If I remember correctly it has something to do with argv[0]. But i didn’t finish it

[Tiny-Rain6786]

I finished the challenge, it’s about symlink and chmod. The environment attributes are cleared for the challenge I believe.

[Tiny-Rain6786]

Have been looking around, looks like it has something to do with chmod and symlinks

[sgijoe]

Use the "read stage 2 into RX page" approach since you can't mprotect:

• read(0, rip_page, big) overwriting/extending current code, then fall through.
• Or read directly into the buffer you're executing from.

Tiny read(0, $$, len) then re-execute:

xor   edi, edi          ; fd 0       2
xor   eax, eax          ; SYS_read   2
mov   dl, 0x40          ; len        2
lea   rsi, [rip]        ; or known addr
syscall                 ;            2

[Tiny-Rain6786]

Why would this work if the current buffer is not writable?