0

I am learning libc shellcode attacks and trying to execute /bin/sh from system

I can execute other commands from system like whoami and ls -a but can not run /bin/sh

the following works

string = b"ls -a\0"
# system, _exit, system arg 
b'\xf0\xef\x04\x08', b'\xe3\xd0\x06\x08', string_addr.to_bytes(4, byteorder='little')

but this doesn't work

string = b"/bin/sh\0"
# system, _exit, system arg 
b'\xf0\xef\x04\x08', b'\xe3\xd0\x06\x08', string_addr.to_bytes(4, byteorder='little')

what is going wrong here?

6
  • I tried to open stdin by open("/dev/tty", O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|O_ASYNC) and "</dev/stdin" but it didn't work. Oct 12, 2020 at 4:56
  • 1
    Can you provide a bit more context ? Have you check existence of /bin/sh ? Did you try to run "sh" without exact location just as you did for "ls" ?
    – w s
    Oct 12, 2020 at 6:57
  • 1
    Are you sure that it's not working or that stdin is just being closed immediately? Oct 12, 2020 at 14:39
  • Thank you for your reply. Yes I am aware of this stdin issue, I tried executing it in various ways like this "/bin/sh -c \"(cat input ; cat -)\"\0" to pass the stdin but it doesn't help. Oct 12, 2020 at 19:22
  • 1
    Crosspost security.stackexchange.com/q/239439/90657 Oct 16, 2020 at 21:57

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.