0

I am learning libc shellcode attacks and trying to execute /bin/sh from system

I can execute other commands from system like whoami and ls -a but can not run /bin/sh

the following works

string = b"ls -a\0"
# system, _exit, system arg 
b'\xf0\xef\x04\x08', b'\xe3\xd0\x06\x08', string_addr.to_bytes(4, byteorder='little')

but this doesn't work

string = b"/bin/sh\0"
# system, _exit, system arg 
b'\xf0\xef\x04\x08', b'\xe3\xd0\x06\x08', string_addr.to_bytes(4, byteorder='little')

what is going wrong here?

  • I tried to open stdin by open("/dev/tty", O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|O_ASYNC) and "</dev/stdin" but it didn't work. – Devharsh Trivedi Oct 12 at 4:56
  • 1
    Can you provide a bit more context ? Have you check existence of /bin/sh ? Did you try to run "sh" without exact location just as you did for "ls" ? – w s Oct 12 at 6:57
  • 1
    Are you sure that it's not working or that stdin is just being closed immediately? – genghiskhan Oct 12 at 14:39
  • Thank you for your reply. Yes I am aware of this stdin issue, I tried executing it in various ways like this "/bin/sh -c \"(cat input ; cat -)\"\0" to pass the stdin but it doesn't help. – Devharsh Trivedi Oct 12 at 19:22
  • 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.