Shellcode not running

Question

I've tried to run a lot of shell-codes via C program to test them. Here it is

#include<stdio.h>
#include<string.h>
unsigned char code[] = "shell here";
main()
{
printf("Shellcode Length: %d\n", strlen(code));
int (*ret)() = (int(*)())code;
ret();
}

And here's example of shellcode

"\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb"\
          "\x16\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89"\
          "\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d\x53\x0c\xcd"\
          "\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f"\
          "\x73\x68\x58\x41\x41\x41\x41\x42\x42\x42\x42"

(\bin\cat \etc\shadow) After running

gcc sctest.c -o out ./out

It's just gives me shellcode length and Segmentation Fault I've already tried a lot of different shellcodes but everything just gives me segfault My dmesg | tail -1 [18440.783383] test[8768]: segfault at 8049700 ip 08049700 sp bffff2ec error 15 in test[8049000+1000] What's wrong with my shellcodes?

Answer 1

After disabling NX-bit and other things like randomize_va_space I've finally done it.

Firstly you should compile your executable with keys -z execstack and -fno-stack-protector.

After that disable ASLR echo 0 > /proc/sys/kernel/randomize_va_space. Now you have to find shellcode. You can try mspayload or msfvenom. Shellcode is a bytecode which usually gives you shell.

On that step you should find offset for your stack overflow. You can try to find lines like

sub hex-offset, %esp

Or you can try to bruteforce it with simple script like ./your_binary < python -c "print('A')*n") where n is your offset

After finding offset(SEGFAULT occurs and dmesg | tail -1 says that %eip is 0x41414141) you just need to write your exploit. It's structure looks like that

NOPs(no operation)*x+shellcode+return-address(4 bytes)*y

len(shellcode)+x+4y=your offset Where return address is an address of the place in the stack where your NOPs are located(address of %esp which you see in gdb info r before input)

And don't forget that exploit which works in gdb won't work without gdb because you need to add/substract 36 bytes from your return address.

Finally you're ready to exploit

./your_binary < exploit.bin