add executable with null byte in data address
This commit is contained in:
parent
2933e3d434
commit
15c38f07df
@ -1 +1 @@
|
|||||||
["/home/vagrant/cw/netcat-0.7.1/src/netcat", "-lnp", "5678", "-tte", "/bin/sh"]
|
["/bin/echo", "\n[ Successful ROP! ]"]
|
6
vuln-programs/.gitignore
vendored
Normal file
6
vuln-programs/.gitignore
vendored
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
# ignore binaries
|
||||||
|
|
||||||
|
*
|
||||||
|
!/**/
|
||||||
|
!*.*
|
||||||
|
!Makefile
|
2
vuln-programs/null-data-addr/Makefile
Normal file
2
vuln-programs/null-data-addr/Makefile
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
null-data-addr: null-data-addr.c
|
||||||
|
gcc -fno-pie -no-pie -fno-stack-protector -m32 -static $^ -o $@ -Tdata 0x080d9100
|
37
vuln-programs/null-data-addr/null-data-addr.c
Normal file
37
vuln-programs/null-data-addr/null-data-addr.c
Normal file
@ -0,0 +1,37 @@
|
|||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <errno.h>
|
||||||
|
int copyData(char *string)
|
||||||
|
{
|
||||||
|
char buf[32];
|
||||||
|
strcpy(buf, string);
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
|
||||||
|
int main(int argc, char *argv[])
|
||||||
|
{
|
||||||
|
char buffer[700];
|
||||||
|
FILE *file;
|
||||||
|
if (argc !=2)
|
||||||
|
{
|
||||||
|
printf("[*] invalid arguments!\n [*] > %s file_name\n",argv[0]);
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
printf("opening file\n");
|
||||||
|
file = fopen(argv[1],"rb");
|
||||||
|
if (!file)
|
||||||
|
{
|
||||||
|
//printf("file not opened %s", strerror(errno));
|
||||||
|
fprintf(stderr,"file not opened %s", strerror(errno));
|
||||||
|
//printf("error");
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
printf("file opened\n");
|
||||||
|
fread(buffer, 699,1,file);
|
||||||
|
fclose(file);
|
||||||
|
copyData(buffer);
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user