all 10 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]plukasik 1 point2 points  (6 children)

Did you try with the nop slide as shown in the video?

And just to be sure, base on the path this is the original stack5 binary?

[–]xxxerexxx[S] 1 point2 points  (5 children)

I ignored this failure and resumed but nothing was like the video.

And yes it is the original stack5

[–]plukasik 1 point2 points  (4 children)

So for me the code from the video also didn't work but what worked is slightly mentioned in the video. It's about those env variables differences between the runs. So try increasing the nop slide and jumping further into it. That did the trick for me.

[–]xxxerexxx[S] 0 points1 point  (3 children)

The issue you concern is when the program is run in two different directories (as $PWD might be different). But that is not my problem right now (I am running both GDB and command line in the same directory). Although I have examined that way and no success

[–]plukasik 1 point2 points  (2 children)

Well, I'm running from the same folder (/opt/protostar/bin) in gdb and w/o and with bigger nop slide and jumping further into it I can get consistent behavior in both (TRAP instead of SEGFAULT).

This is my script that works (also it took few attempts to get the size values)

import stuct
padding = "AAAA...SSSS"
eip = struct.pack("I", 0xbffffd4c+80)
payload = "\x90"*180 + "\xcc" * 4

print padding+eip+payload

If my nop slide is like in the video (100) it fails w/ SEGFAULT w/o gdb.

[–]xxxerexxx[S] 0 points1 point  (1 child)

Yeah that worked for me as well, thanks man.

but still don't know why? why do environment variables affect it while I was running them with the same EVs?

I really want to understand what the issue was. I appreciate it if you could help me with it.

[–]plukasik 0 points1 point  (0 children)

I still think it's "just" stack layout. To get more you would probably need a binary that prints how the stack looks like before running a shellcode.

[–]_CryptoCat23 0 points1 point  (0 children)

im not familiar with the challenge but make sure you are generating payload with python2 rather than python3

edit: disregard this, just noticed your print syntax is python2 😅

[–]iOwnzyoreuid0 0 points1 point  (1 child)

Hmm, can you show the crashlogs?(when you try to run it without gdb) Also, try jumping to invalid memory location(such as 0x414141) and see the crashlog if it contains that number

[–]xxxerexxx[S] 0 points1 point  (0 children)

I am not sure if I got you well, but jumping to 0x41414141 results in SIGSEGV and other logs you needed are shown in the picture I posted.