diff --git a/rop_exec.json b/rop_exec.json index a9f21b7..f206242 100644 --- a/rop_exec.json +++ b/rop_exec.json @@ -1 +1 @@ -["/home/vagrant/cw/netcat-0.7.1/src/netcat", "-lnp", "5678", "-tte", "/bin/sh"] \ No newline at end of file +["/bin/echo", "\n[ Successful ROP! ]"] \ No newline at end of file diff --git a/vuln-programs/.gitignore b/vuln-programs/.gitignore new file mode 100644 index 0000000..1d46c70 --- /dev/null +++ b/vuln-programs/.gitignore @@ -0,0 +1,6 @@ +# ignore binaries + +* +!/**/ +!*.* +!Makefile diff --git a/vuln-programs/null-data-addr/Makefile b/vuln-programs/null-data-addr/Makefile new file mode 100644 index 0000000..c8caea0 --- /dev/null +++ b/vuln-programs/null-data-addr/Makefile @@ -0,0 +1,2 @@ +null-data-addr: null-data-addr.c + gcc -fno-pie -no-pie -fno-stack-protector -m32 -static $^ -o $@ -Tdata 0x080d9100 diff --git a/vuln-programs/null-data-addr/null-data-addr.c b/vuln-programs/null-data-addr/null-data-addr.c new file mode 100644 index 0000000..4715064 --- /dev/null +++ b/vuln-programs/null-data-addr/null-data-addr.c @@ -0,0 +1,37 @@ +#include +#include +#include +#include +int copyData(char *string) +{ + char buf[32]; + strcpy(buf, string); + return (0); +} + +int main(int argc, char *argv[]) +{ + char buffer[700]; + FILE *file; + if (argc !=2) + { + printf("[*] invalid arguments!\n [*] > %s file_name\n",argv[0]); + exit(0); + } + printf("opening file\n"); + file = fopen(argv[1],"rb"); + if (!file) + { + //printf("file not opened %s", strerror(errno)); + fprintf(stderr,"file not opened %s", strerror(errno)); + //printf("error"); + return (0); + } + printf("file opened\n"); + fread(buffer, 699,1,file); + fclose(file); + copyData(buffer); + return (0); +} + +