csegmentation-fault

Got segfault with a program to test shellcode


I found this C code example to run shellcode, but it cases segmentation fault for me. It doesn't cause segmentation fault on my friend's machine though, so I am wondering if it is a version issue. Is char causing the segmentation fault?

#include<stdio.h>
#include<string.h>

unsigned char code[] = \
"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";

main()
{

  printf("Shellcode Length:  %d\n", strlen(code));

    int (*ret)() = (int(*)())code;

    ret();

}

Solution

  • In order for your shellcode to properly work, you'll have to compile your program with the -z execstack flag. This disables the NX protection which is enabled by default and prevents pages holding data from being marked as executable. If you don't disable NX the program will segfault because the memory page where your shellcode string is going to be put is not going to be executable, and the process will get killed when trying to execute its content.

    NOTE: as of Linux 5.8 (if I am not mistaken) this will no longer work because -z execstack only affects the stack, so you will either have to mmap() RWX memory, then copy the shellcode there, or compile the program and then manually edit the program headers to change the permissions of the program header containing the .data section. See this other answer of mine for more info.

    I also see an int 0x80 in your shellcode so I assume this is supposed to be an x86 32bit shellcode. Other than that you're missing an int in front of main(), but I guess that's a copy-paste error.

    Compile your program with:

    gcc -m32 -z execstack prog.c