shellcode is truncated by \x20

Question

Why is my shellcode is truncated after \x20 opcode, when it is copied by string to stack on a second vulnerable program?

--cmd.exe--
 char shell[]=

"\xc7\x44\x24\x0c\x65\x78\x65\x20" ← only this line is put in stack, though hv a enough space 
"\xc7\x44\x24\x08\x63\x6d\x64\x2e"
"\x31\xc0"
"\x89\x44\x24\x04"
"\x8d\x44\x24\x08"
"\x89\x04\x24"
"\x8d\x05\xad\x23\x86\x7c"
"\xff\xd0";
--end shell--

If you can't answer that, you really should not be playing with it. :-) — , Mar 18 '10 at 02:20

score 2 · Answer 1 · edited Feb 02 '13 at 17:47

2

Put a double quotations around the entire command. For example, run:

"$shellcode" (gdb)r "$(python -c 'print "\x41" * 100 + "\x20\x83\x04\x08" + ....')"

edited Feb 02 '13 at 17:47

cheesemacfly

10,986
11
45
69

answered Feb 02 '13 at 17:17

Omarix

21
1

score 2 · Accepted Answer · answered Mar 18 '10 at 02:33

2

Are you passing this shellcode as a command-line argument? In that case, take a look at the ASCII code for 0x20 ;)

answered Mar 18 '10 at 02:33

BlueRaja - Danny Pflughoeft

75,675
28
177
259

Tks Raja to Aswer:]) So, I'm passing this by a function C of the kernel32.dll library call WinExec() and compiled by DEVC++ ..I'm try a Poc to my own deepening knowledge...Does what's wrong? – Mar 19 '10 at 00:25
Yep that would do it; the usual solution is to surround the command-line argument with quotes, but I'm not sure how the command-line parser would handle this case - after all, you're not meant to be passing around shell-code like this ;) – BlueRaja - Danny Pflughoeft Mar 19 '10 at 13:36

score 1 · Answer 3 · answered Mar 10 '11 at 05:03

My theory is that things like quote, space, null, etc are being interpreted by the windows shell rather than being sent through. You could escape it somehow, but I think it's easier to just encode the shellcode. So try metasploit's msfencode utility to avoid those opcodes altogether. I know null (/x00), space (/x20) and quote (/x22) can't be passed directly, but I suppose that there are other opcodes that can't be passed as well.

That's my solution, but does anyone know of any other ones that are better?

score 0 · Answer 4 · answered Jan 18 '20 at 14:57

0

\x20 like <space> in ASCII format

answered Jan 18 '20 at 14:57

VIII

443
6
14

shellcode is truncated by \x20

4 Answers4