1

I am learning assembly and I wrote this shellcode which is supposed to open the Google homepage on firefox. However it doesn't do anything (and even segfaults at the end because of an added instruction add %al,(%rax) which I don't understand), do I do things right ? I am actually not even sure I encoded the strings correctly. Thanks !

global _start

_start:
xor rax, rax
push rax

;https:////www.google.com
push 0x6d6f632e656c676f
push 0x6f672e7777772f2f
push 0x2f2f3a7370747468

mov rcx, rsp

push 0x786f66657269662f ; /firefox
push 0x6e69622f7273752f ; /usr/bin

mov rdi, rsp

push rax
push    rcx
push    rdi
mov     rsi, rsp

; execve
mov     al, 0x3b
syscall

I test my code with :

char code[] = \x48\x31\xc0\x50\x68\x6f\x67\x6c\x65\x68\x2f\x2f\x77\x77\x68\x68\x74\x74\x70\x48\x89\xe1\x68\x2f\x66\x69\x72\x68\x2f\x75\x73\x72\x48\x89\xe7\x50\x51\x57\x48\x89\xe6\xb0\x3b\x0f\x05
int main(int argc, char **argv){
   (*(void(*)()) code)();
   return 0;
}`
melpomene
  • 84,125
  • 8
  • 85
  • 148
gaj
  • 13
  • 4
  • 1
    Are you sure the pushes are correct? As far as I'm concerned, there is no `push imm64` in amd64 assembly. – fuz Oct 01 '18 at 20:23
  • `add %al,(%rax)` is how `00 00` decodes. It means execution went past your code into padding. It also means you didn't use GDB's `set disassembly-flavor intel` to match your NASM code. BTW, @fuz is correct, there is no `push imm64`. This code is doomed to failure; you should have gotten warnings from NASM about truncating values too large to fit: [How to push a 64bit int in NASM?](https://stackoverflow.com/q/16917643) – Peter Cordes Oct 02 '18 at 00:20
  • You're right, I changed the code to go through a register to do the all the "push" – gaj Oct 02 '18 at 07:14

1 Answers1

2

You missed a null terminator on the firefox path. Add a push rax before the firefox hex just like you did with google.com.

Also, to make sure you don't crash due to the lack of an envp variable (i.e. a random rdx), add this line when constructing rsi

...
push    rax
mov     rdx, rsp # Add this to set rdx = [null]
push    rcx
...

This passes in an empty array to envp through the rdx register.

Finally: Normally the push rax is a hack to get past null & newline blocked string inputs. If you're just calling it within your own c code, you can use push 0 instead of push rax and forget the top line xor (Using mov rax, 0x3b for the syscall). You can leave it as-is. This was just a note.

Nicholas Pipitone
  • 4,002
  • 4
  • 24
  • 39
  • Thank you very much! Yes, I just figured out that the problem was due to the random rdx, it's working now – gaj Oct 01 '18 at 20:00