modify the return address to shellcode
Posted: Tue Oct 21, 2014 2:05 pm
i have tow C program. one is shellcode and the other vulnerable program.
i want to change the return address with out buffering the vulnerable program.
like for example:-
shellcode program
vulnerable program
i want to change the return address with out buffering the vulnerable program.
like for example:-
but this method doesn't work for me, i have tried running the vulnerable program in linux with gdb and redirect shellcode to it (gdb) run vuln < shellcode but eip or ebp never change. can someone look at my shellcode program and see where's the error is.__asm__("movl $shellcode, 4(%ebp)");
shellcode program
Code: Select all
#include <stdio.h>
#include <stdlib.h>
void shellcode() {
__asm__(".byte 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90"); /* you may put your shellcode here */
printf("hey guyz!\n");
exit(0);
}
void bang(int val) {
__asm__("movl $shellcode, 4(%ebp)");
}
int main() {
bang(0);
}
Code: Select all
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(char *string) {
char buffer[1024];
strcpy(buffer, string);
return 1;
}
int main(int argc, char *argv[]) {
bof(argv[1]);
printf("Done..\n");
return 1;
}