0

I am learning libc shellcode attacks and trying to execute /bin/sh from system

I can execute other commands from system like whoami and ls -a but can not run /bin/sh

the following works

string = b"ls -a\0"
# system, _exit, system arg 
b'\xf0\xef\x04\x08', b'\xe3\xd0\x06\x08', string_addr.to_bytes(4, byteorder='little')

but this doesn't work

string = b"/bin/sh\0"
# system, _exit, system arg 
b'\xf0\xef\x04\x08', b'\xe3\xd0\x06\x08', string_addr.to_bytes(4, byteorder='little')

what is going wrong here?

6
  • I tried to open stdin by open("/dev/tty", O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|O_ASYNC) and "</dev/stdin" but it didn't work. Commented Oct 12, 2020 at 4:56
  • 1
    Can you provide a bit more context ? Have you check existence of /bin/sh ? Did you try to run "sh" without exact location just as you did for "ls" ?
    – w s
    Commented Oct 12, 2020 at 6:57
  • 1
    Are you sure that it's not working or that stdin is just being closed immediately? Commented Oct 12, 2020 at 14:39
  • Thank you for your reply. Yes I am aware of this stdin issue, I tried executing it in various ways like this "/bin/sh -c \"(cat input ; cat -)\"\0" to pass the stdin but it doesn't help. Commented Oct 12, 2020 at 19:22
  • 1
    Crosspost security.stackexchange.com/q/239439/90657 Commented Oct 16, 2020 at 21:57

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.