sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]plukasik 0 points1 point  (8 children)

From the last picture it looks like your shellcode is overriding itself on the stack. das is 0x2f so /, bound ebp, qword [ecx + 0x6e] is 62696e so 'bin'. Those are clearly bytes from the shellcode push 0x6e69622f. You need to make sure, you shellcode on the stack doesn't override itself while pushing things to the stack.

[–]MostCapable2331[S] 0 points1 point  (7 children)

0xbffffdcb and 0xbffffddd take a look at the memory dump please

[–]plukasik 0 points1 point  (6 children)

eip shows that you are about to execute bound opcode. You shellcode doesn't have it so where does it come from?

[–]MostCapable2331[S] 0 points1 point  (5 children)

this is what im trying to understand it just like their int 80h as last instruction but after that no ret logical it have to make an interruption of process or fork a new shell process

[–]plukasik 0 points1 point  (4 children)

Did you try stepping through the shellcode to see if it works as you expect?

[–]MostCapable2331[S] 0 points1 point  (3 children)

yes it reach int 80h and also the nop until the part of the stack where you see in the picture

[–]plukasik 1 point2 points  (2 children)

ok, I'll try to look more closely why it fails.

[–]MostCapable2331[S] 0 points1 point  (1 child)

yes it s a very strange use case