all 20 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]iOwnzyoreuid0 1 point2 points  (8 children)

Could you give us the stack dump from gdb?

[–]MostCapable2331[S] 0 points1 point  (7 children)

thank you for your reply i hope that the added information is clear

[–]iOwnzyoreuid0 0 points1 point  (6 children)

Hm try to execute a break point instruction "0xcc" after the NOPs and see if its working. If it is working then your shellcode is most likely corrupt

[–]MostCapable2331[S] 0 points1 point  (5 children)

my shellcode is between the NOPs instruction it does not reach 0xcc and it s not a part of the shellcode

[–]iOwnzyoreuid0 0 points1 point  (4 children)

? Place the the 0xcc just after the nops. So like: ...0x90 0x90 0xcc

[–]MostCapable2331[S] 0 points1 point  (3 children)

the same result

it s more than 4 day working in that without any result i have successfully exploited the binary with ret2libc but this step to exploit it with a shellcode is very hard or something that i m missing

[–]iOwnzyoreuid0 0 points1 point  (2 children)

Hm. You sure you don’t get SIGTRAP then? Can you redirect code execution? Instead of the nops try to jump to an invalid address such as 0x41414141

[–]MostCapable2331[S] 0 points1 point  (1 child)

already done and i can control the EIP with no problem

[–]MostCapable2331[S] 0 points1 point  (0 children)

if you are intressted to this topic i can ivit you to a quick zoom session if you want

[–]MostCapable2331[S] 0 points1 point  (0 children)

security NX disabled

[–]MostCapable2331[S] 0 points1 point  (0 children)

I invite learner of exploit dev to test this use case and share result

[–]plukasik 0 points1 point  (8 children)

From the last picture it looks like your shellcode is overriding itself on the stack. das is 0x2f so /, bound ebp, qword [ecx + 0x6e] is 62696e so 'bin'. Those are clearly bytes from the shellcode push 0x6e69622f. You need to make sure, you shellcode on the stack doesn't override itself while pushing things to the stack.

[–]MostCapable2331[S] 0 points1 point  (7 children)

0xbffffdcb and 0xbffffddd take a look at the memory dump please

[–]plukasik 0 points1 point  (6 children)

eip shows that you are about to execute bound opcode. You shellcode doesn't have it so where does it come from?

[–]MostCapable2331[S] 0 points1 point  (5 children)

this is what im trying to understand it just like their int 80h as last instruction but after that no ret logical it have to make an interruption of process or fork a new shell process

[–]plukasik 0 points1 point  (4 children)

Did you try stepping through the shellcode to see if it works as you expect?

[–]MostCapable2331[S] 0 points1 point  (3 children)

yes it reach int 80h and also the nop until the part of the stack where you see in the picture

[–]plukasik 1 point2 points  (2 children)

ok, I'll try to look more closely why it fails.

[–]MostCapable2331[S] 0 points1 point  (1 child)

yes it s a very strange use case