#include #include #include #define BUFFER_SIZE 64 #define MAX_SIZE BUFFER_SIZE*2 /** gcc -m32 -o intOverflow intOverflow.c **/ int vulnConcat(char ** argv){ char buffer[MAX_SIZE] = {0}; char command[10] = "/bin/date"; char size = strlen(argv[1]); if (size >= BUFFER_SIZE){ printf("Go home to your mother, Luke! \n"); return 0; } strncpy(buffer, argv[1], BUFFER_SIZE); int i; for(i = 0; i < BUFFER_SIZE && argv[1][i] != '\0'; i++){ buffer[size+i] = argv[1][i]; } printf("Concatenation: %s\n", buffer); printf("Executing : %s\n", command); system(command); return 1; } int main(int argc, char ** argv){ if(argc != 2){ printf("RTFM, I need one argument\n"); return 1; } vulnConcat(argv); return 0; }