un4ckn0wl3z

//vuln.c
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

void store_passwd_indb(char* passwd) {
}

void validate_uname(char* uname) {
}

un4ckn0wl3z

(gdb) set disassembly-flavor intel 
(gdb) disass validate_passwd 
Dump of assembler code for function validate_passwd:
   0x0804849e <+0>:	push   ebp
   0x0804849f <+1>:	mov    ebp,esp
   0x080484a1 <+3>:	push   edi
   0x080484a2 <+4>:	sub    esp,0x34
   0x080484a5 <+7>:	mov    eax,DWORD PTR [ebp+0x8]
   0x080484a8 <+10>:	mov    DWORD PTR [ebp-0x1c],0xffffffff
   0x080484af <+17>:	mov    edx,eax

un4ckn0wl3z

#exp.py 
#!/usr/bin/env python
import struct
from subprocess import call

arg1 = "sploitfun"

#Stack address where shellcode is copied.
ret_addr = 0xbffff274

un4ckn0wl3z

#!/usr/bin/python

##############################################################
# PyInstaller Win32 shellcode runner - by @mihi42
#
# Needed software:
# * Python 2.7.2 from 
#   <http://www.python.org/download/releases/>
# * PyWin32 build 217 for Python 2.7 from 
#   <http://sourceforge.net/projects/pywin32/files/pywin32/>

un4ckn0wl3z

main( ) {
 printf("hello, world");
 } 

un4ckn0wl3z

main( ) {
 int a, b, c, sum;
 a = 1; b = 2; c = 3;
 sum = a + b + c;
 printf("sum is %d", sum);
 } 

un4ckn0wl3z

char quest, newline, flags;
 quest = '?';
 newline = '\n';
 flags = 077; 

un4ckn0wl3z

main( ) {
 char c;
 c = getchar( );
 putchar(c);
 printf ("hello, world\n"); 
 int sum = 6;
 printf ("sum is %d\n", sum); 
 } 

un4ckn0wl3z

c = getchar( );
 if( c == '?' )
 printf("why did you type a question mark?\n"); 

un4ckn0wl3z

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $srcPortNumber -j REDIRECT --to-port $dstPortNumber