BOF Vulnerable App

; *************************************************************************
; 32-bit Windows Console Buffer Overflow Program
; Created by Ismael Vazquez (@iamismael_)
; *************************************************************************

.386                    ; Enable 80386+ instruction set
.model flat, stdcall    ; Flat, 32-bit memory model (not used in 64-bit)
option casemap: none    ; Case insensitive syntax

; *************************************************************************
; MASM32 proto types for Win32 functions and structures
; *************************************************************************
include c:\masm32\include\kernel32.inc
include c:\masm32\include\masm32.inc
include c:\masm32\include\msvcrt.inc

; *************************************************************************
; MASM32 object libraries
; *************************************************************************
includelib c:\masm32\lib\kernel32.lib
includelib c:\masm32\lib\masm32.lib
includelib c:\masm32\lib\msvcrt.lib

; *************************************************************************
; External function definitions
; *************************************************************************
strcpy proto C, :DWORD, :DWORD

; *************************************************************************
; Our data section. Here we declare our strings for our message
; *************************************************************************
.data
arg1 db "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBCCCCC", 00h

; *************************************************************************
; Our executable assembly code starts here in the .code section
; *************************************************************************
.code

start:
    Main Proc
        ; function prologue
        push ebp
        mov ebp, esp

        ; add 20 bytes of stack space for local variables
        ; 4 = DWORD
        ; 16  = char array
        sub esp, 014h

        ; int var1 = 0x1337
        mov dword ptr [esp], 01337h

        ; Load the address of ESP(minus the 4 bytes we reserved for our DWORD) into EAX
        lea eax, dword ptr [esp + 04h]

        ; Mimicking command line argument(72 bytes long)
        push offset arg1
        ; pass our destination buffer to strcpy
        push eax
        call strcpy

        ; clear arguments to strcpy off the stack
        add esp, 08h

        ; function epilogue
        pop ebp
        mov esp, ebp

        ; exit
        push 0h
        call ExitProcess
        ret
    Main EndP
end start