simple strcpy() exploit works

1 files changed, 8 insertions, 19 deletions

diff --git a/overflow.c b/overflow.c
index e91c0b7..8fb07b9 100644
--- a/overflow.c
+++ b/overflow.c
@@ -9,39 +9,28 @@
 #include <stdio.h>
 #include <string.h>
 
-#define ENV_VAR   "EXPLOIT"
-#define BUFLEN    10
-
+/* 300 bytes buffer len + 4 bytes for overwrite return opcode */
+#define BUFLEN    300
 
 void
 overflow(const char *src, char *dst)
 {
   /* exploitable function */
   strcpy(dst, src);
+  /* nothing to do, just return */
 }
 
 int
 main(int argc, char **argv)
 {
-  char *s, *env;
   char buf[BUFLEN];
 
-  fprintf(stderr, "buflen: %d\nenv_var: %s\nargs: %d\n\n", BUFLEN, ENV_VAR, (argc - 1));
-  if (argc > 1)
-    {
+  if (argc > 1) {
       overflow(argv[1], buf);
-    }
-  else if ((env = getenv(ENV_VAR)))
-    {
-      overflow(env, buf);
-    }
-  else
-    {
-      fprintf(stderr, "neither "ENV_VAR" set or arg0 given, abort!\n");
-      return(1);
-    }
-
-  printf("buf: %s\n*buf: %p\nbuflen: %d\n", s, s, strlen(s));
+  } else {
+    fprintf(stderr, "arg1 missing\n");
+    return(1);
+  }
 
   return (0);
 }