I found this C code example to run shellcode, but it cases segmentation fault for me. It doesn't cause segmentation fault on my friend's machine though, so I am wondering if it is a version issue. Is char
causing the segmentation fault?
#include<stdio.h>
#include<string.h>
unsigned char code[] = \
"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
main()
{
printf("Shellcode Length: %d\n", strlen(code));
int (*ret)() = (int(*)())code;
ret();
}
In order for your shellcode to properly work, you'll have to compile your program with the -z execstack
flag. This disables the NX protection which is enabled by default and prevents pages holding data from being marked as executable. If you don't disable NX the program will segfault because the memory page where your shellcode string is going to be put is not going to be executable, and the process will get killed when trying to execute its content.
NOTE: as of Linux 5.8 (if I am not mistaken) this will no longer work because -z execstack
only affects the stack, so you will either have to mmap()
RWX memory, then copy the shellcode there, or compile the program and then manually edit the program headers to change the permissions of the program header containing the .data
section. See this other answer of mine for more info.
I also see an int 0x80
in your shellcode so I assume this is supposed to be an x86 32bit shellcode. Other than that you're missing an int
in front of main()
, but I guess that's a copy-paste error.
Compile your program with:
gcc -m32 -z execstack prog.c