I have a victim program (with a buffer overrun vulnerability): it uses gets() to write into a fixed-sized buffer.

Suppose I put shellcode into a file SC. Then I run

$ ./victim < SC
Input your data: 

The reason the shellcode does not seem to work is this: SC is redirected to the victim, injects the shellcode, causes a shell to spawn, but the spawned shell finds its stdin is closed, so immediately exits.

I tried expect for the injection, but expect bombs after the shell spawns.

It seems like the only practical way is to get the shellcode into my mouse's paste buffer so I can inject it while retaining the keyboard as the input device. But I have no idea how to get binary data into my paste buffer.

Any ideas on how to get around this issue?

  • Instead of doing this via the clipboard, can't you inject the shellcode through a pipe? If you don't close it, the spawned shell won't die because of a closed stdin. – lgeorget Apr 25 '13 at 19:39
  • @lgeorget Can you elaborate? $ cat SC | ./victim has the same problem because the EOF from the cat is seen by the shell, so it terminates. – Fixee Apr 25 '13 at 21:09
  • 1
    Turns out $ cat SC - | ./victim works. See my answer below. – Fixee Apr 25 '13 at 22:30

A solution to this problem (which someone ran into in the same context) is here: https://stackoverflow.com/questions/8509045/execve-bin-sh-0-0-in-a-pipe


You could do that with a simple script in which you print your special characters.

For example, in Perl, you can print any character by specifying its hexadecimal code. For example: perl -e 'print "\x54\x0A"' prints a 'T' followed by a new line.

You can then copy the text printed, even if it not visible. Of course, your terminal must be in raw mode.

  • hmm, wait a little before voting up. I've already done such things but it's not really as easy as that... – lgeorget Apr 25 '13 at 19:22
  • I use PuTTY... no idea how to get this "raw mode" you speak of. But if I could, that would solve my problem. – Fixee Apr 25 '13 at 19:29
  • At the low level, there is an ioctl(2) for that. In a shell, I usually get the "raw mode" through socat(1). – lgeorget Apr 25 '13 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.