shellcode error Segmentation fault (core dumped)

Question

im new at shellcoding i try to write a shellcode for ( hello world ) so this is my first code with nulled bytes :

global _start

section     .text

_start:                                         ;tell linker entry point

    mov     edx,len                             ;message length
    mov     ecx,msg                             ;message to write
    mov     ebx,1                               ;file descriptor (stdout)
    mov     eax,4                               ;system call number (sys_write)
    int     0x80                                ;call kernel

    mov     eax,1                               ;system call number (sys_exit)
    int     0x80                                ;call kernel

section     .data

msg     db  'Hello, world!',0xa                 ;our dear string
len     equ $ - msg                             ;length of our dear string

and this is my second code after i remove null x00 !!

global _start

section     .text

_start: 
                                            ;tell linker entry point
    xor     edx,edx     
    mov     dl,len                             ;message length
    mov     ecx,msg                             ;message to write
    xor     ebx,ebx
    mov     bl,1                               ;file descriptor (stdout)
    xor     eax,eax
    mov     al,4                               ;system call number (sys_write)
    int     0x80                                ;call kernel
    xor     eax,eax
    mov     al,1                               ;system call number (sys_exit)
    int     0x80                                ;call kernel

section     .data

msg     db  'Hello, world!',0xa                 ;our dear string
len     equ $ - msg                             ;length of our dear string

i compile it to test by :

nasm -f elf32 -o hello-without-null.o hello-without-null.asm

ld -o hello-without-null hello-without-null.o

its work when i run it ./hello-without-null

than i used : objdump -d hello-without-null -M intel

and this is the result :

Disassembly of section .text:

08048080 <_start>:
 8048080:   31 d2                   xor    edx,edx
 8048082:   b2 0e                   mov    dl,0xe
 8048084:   b9 9c 90 04 08          mov    ecx,0x804909c
 8048089:   31 db                   xor    ebx,ebx
 804808b:   b3 01                   mov    bl,0x1
 804808d:   31 c0                   xor    eax,eax
 804808f:   b0 04                   mov    al,0x4
 8048091:   cd 80                   int    0x80
 8048093:   31 c0                   xor    eax,eax
 8048095:   b0 01                   mov    al,0x1
 8048097:   cd 80                   int    0x80

then i convert it to shellcode by :

objdump -d ./hello-without-null|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'

the output is :

"\x31\xd2\xb2\x0e\xb9\x9c\x90\x04\x08\x31\xdb\xb3\x01\x31\xc0\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80"

when i test it i got this error :

Shellcode Length: 25 Segmentation fault (core dumped)

my c code for testing :

#include<stdio.h>
#include<string.h>

unsigned char code[] = \
"\x31\xd2\xb2\x0e\xb9\x9c\x90\x04\x08\x31\xdb\xb3\x01\x31\xc0\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

int main()
{

        printf("Shellcode Length:  %d\n", strlen(code));

        int (*ret)() = (int(*)())code;

        ret();


}

so what is the problem ?? and how i can solve it ?

one way would be to put your shellcode in a const char[] array, so it goes into the .rodata section in the TEXT segment (with exec permission), instead of .data (read/write, no exec). — Peter Cordes
– Peter Cordes, Commented Dec 3, 2018 at 14:00
I recommend you consider looking into using the JMP/CALL/POP method or something else that avoids the generation of absolute memory addresses. mov ecx,msg will not work as the address of msg will not be the same when run inside the C program.The alternative is to build the sring on the stack and pass the stack address. — Michael Petch
– Michael Petch, Commented Dec 3, 2018 at 15:29

evilcode1 · Accepted Answer · 2018-12-03 16:10:57Z

1

i solve it by changing

char shellcode[]

to

const char shellcode[]

and using using the JMP/CALL/POP method

answered Dec 3, 2018 at 16:10

evilcode1

1312 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

shellcode error Segmentation fault (core dumped)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related