32位程序exec（）是一个64位程序

Question

On my Debian amd64 system, I am trying to run tests of 32-bit exploit payloads on sample programs. I know these payloads work as I have tested them in a 32-bit virtual machine.

All of the necessary libraries are installed to run a 32-bit or 64-bit program.

However, when the shellcode executes int 80h to call exec("/bin/sh", ...) , the system call fails, returning an error code of -2 (ENOENT).

Modification of the shellcode to execute another 32-bit program results in the shellcode working as expected.

So, is there any way to exec() a 64-bit program from a 32-bit program?

Answer 1

It works when using the execl library function.

It may be difficult to call a library function from shell code, but you can try to trace its execution in a normal program and see how to write shell code that does the same.