Re: Re: Linux restricted ASCII Shellcode

Yes I'm having a seg-fault, but I can't catch you...
AFAIK when EIP is pointing somewhere in the NOP sled, no matter how the shellcode is aligned... Alignment has nothing to do here...?¿? I'm wrong?
More over, I've tryed more than 5 different ASCII shellcodes all with the same result... Always segfaulting. It looks as if shellcodes where not working for any common reason...
So, summarizing:
1.- I can perfectly overwrite RET thus having EIP pointing almost 100% of the time to the NOP's of my shellcode (in an environment variable)
2.- My -non-ascii- shellcode works perfectly
3.- Whn I try with ANY pure ascii shellcode, it fails 100% of the time.

What is happening?

I've tryed with pure ASCII shellcodes ripped from http://shellcode.org/Shellcode/linux/ascii/ among others...

Metasploit framework failed to convert the original shellcode -the one that works- to pure ascii with the selected charset (A-Z,a-z,0-9).

That's the original shellcode:

\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh

Is anyone able to convert this to pure ASCII or giving me a working pure ASCII shellcode or helping me understand why all the pure ascii shellcodes are failing in my exploit?

Thank you,

Relevant Pages

  • Re: Linux restricted ASCII Shellcode
    ... Here you have you shellcode in ascii format. ... AFAIK when EIP is pointing somewhere in the NOP sled, no matter how the shellcode is aligned... ... Is anyone able to convert this to pure ASCII or giving me a working pure ASCII shellcode or helping me understand why all the pure ascii shellcodes are failing in my exploit? ...
    (Vuln-Dev)
  • Re: Help developing an exploit
    ... shellcode because as you said ... your shellcode directly into EIP, ... "After you overflow the stack do any of the registers ... into EAX, EDX, and EIP at various points. ...
    (Vuln-Dev)
  • Re: Jump back to shellcode Windows overflow
    ... Have you tried putting your shellcode after the saved EIP? ... Use the fact that ESP points to just after the location of the saved ... > that value into eax followed by a jump eax. ...
    (Vuln-Dev)
  • [Full-Disclosure] Re: Internet Explorer >=5.0 : Buffer overflow
    ... I can confirm it under Windows 2000 with IE 5.50.4807.2300 ... Full control over the EIP, but the shellcode cannot contain (as it currently ...
    (Securiteam)
  • [Full-Disclosure] Re: Internet Explorer >=5.0 : Buffer overflow
    ... I can confirm it under Windows 2000 with IE 5.50.4807.2300 ... Full control over the EIP, but the shellcode cannot contain (as it currently ...
    (Full-Disclosure)