Sponsored Content
Full Discussion: Shellcode Generation using C
Top Forums Programming Shellcode Generation using C Post 302139526 by porter on Monday 8th of October 2007 12:20:37 AM
Old 10-08-2007
Imagine a program which normally prints "Hello World".

Then there is another program which uses that output...

char buf[32];
FILE *fp=popen("hello","r");
fread(buf,1,256,fp);
pclose(fp);

.. and it so happens that this always works because "hello" never returns more than 32 characters. One day it returns more, and then overruns the buffer affecting the return address. The function then returns into hyperspace.
 

7 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

report generation

Hello, I got a requirement in writing a sheel script in unix, please help me out the requirement is there are two folders Folder1 and Folder2 and there are same files in the different folders. like file1,file2 in folder1 and file1 and file2 in folder2. I would like to compare all the... (2 Replies)
Discussion started by: gmahesh2k
2 Replies

2. Shell Programming and Scripting

Report generation

Hello, I got a requirement in writing a KSH script in unix, please help me out the requirement is there are two folders Folder1 and Folder2 and there are same files in the different folders. like file1,file2 in folder1 and file1 and file2 in folder2. I would like to compare all the similar... (3 Replies)
Discussion started by: gmahesh2k
3 Replies

3. Shell Programming and Scripting

Graph generation

How can I generate graphs using perl in unix solaris environment? Please suggest. (2 Replies)
Discussion started by: wadhwa.pooja
2 Replies

4. Shell Programming and Scripting

Help with excelsheet generation

Hi All, i have around 50 queries in sybase. We have a requirement where we need to write a unix script, which execute the query one by one & generate the excel sheet & send it to user. I have completed half of the part, where i am executing query one by one & putting the result into a .txt... (4 Replies)
Discussion started by: Amit.Sagpariya
4 Replies

5. Programming

Passing arguments to shellcode

Is there any way I could pass arguments to shellcode. My goal is to store a program in a image file, and have another program read and run the code with arguments in memory. Currently I can store a program in a image file, then read it back to the hard-drive run it normally then delete it when... (5 Replies)
Discussion started by: image28
5 Replies

6. UNIX for Dummies Questions & Answers

Difference Shellcode and Shell scripting

Heey guys I am new to Unix and got a question on scripting (bash etc.) I now and then stumble into some tutorials on shellcoding after which I completely lose it. The question is: what is the difference between shellcoding, shell scripting and shell programming. I searched on google, but it... (1 Reply)
Discussion started by: Kealthes
1 Replies

7. Cybersecurity

basic shellcode - why it runs on my system, if .data is not executable

Greetings, Suppose we have this piece of code, on Linux/i686 (my machine is Slackware Linux 13.1, 32 bit): char sc= /* 24 bytes */ "\x31\xc0" /* xorl %eax,%eax */ "\x50" /* pushl %eax ... (2 Replies)
Discussion started by: aigoia
2 Replies
popen(3C)						   Standard C Library Functions 						 popen(3C)

NAME
popen, pclose - initiate a pipe to or from a process SYNOPSIS
#include <stdio.h> FILE *popen(const char *command, const char *mode); int pclose(FILE *stream); DESCRIPTION
The popen() function creates a pipe between the calling program and the command to be executed. The arguments to popen() are pointers to null-terminated strings. The command argument consists of a shell command line. The mode argument is an I/O mode, either r for reading or w for writing. The value returned is a stream pointer such that one can write to the standard input of the command, if the I/O mode is w, by writing to the file stream (see intro(3)); and one can read from the standard output of the command, if the I/O mode is r, by reading from the file stream. Because open files are shared, a type r command may be used as an input filter and a type w as an output filter. The environment of the executed command will be as if a child process were created within the popen() call using fork(2). If the applica- tion is standard-conforming (see standards(5)), the child is invoked with the call: execl("/usr/xpg4/bin/sh", "sh", "-c", command, (char *)0); otherwise, the child is invoked with the call: execl("/usr/bin/sh", "sh", "-c", command, (char *)0); The pclose() function closes a stream opened by popen() by closing the pipe. It waits for the associated process to terminate and returns the termination status of the process running the command language interpreter. This is the value returned by waitpid(3C). See wait.h(3HEAD) for more information on termination status. RETURN VALUES
Upon successful completion, popen() returns a pointer to an open stream that can be used to read or write to the pipe. Otherwise, it returns a null pointer and may set errno to indicate the error. Upon successful completion, pclose() returns the termination status of the command language interpreter as returned by waitpid(). Other- wise, it returns -1 and sets errno to indicate the error. ERRORS
The pclose() function will fail if: ECHILD The status of the child process could not be obtained, as described in the DESCRIPTION. The popen() function may fail if: EMFILE There are currently FOPEN_MAX or STREAM_MAX streams open in the calling process. EINVAL The mode argument is invalid. The popen() function may also set errno values as described by fork(2) or pipe(2). USAGE
If the original and popen() processes concurrently read or write a common file, neither should use buffered I/O. Problems with an output filter may be forestalled by careful buffer flushing, for example, with fflush() (see fclose(3C)). A security hole exists through the IFS and PATH environment variables. Full pathnames should be used (or PATH reset) and IFS should be set to space and tab (" "). The signal handler for SIGCHLD should be set to default when using popen(). If the process has established a signal handler for SIGCHLD, it will be called when the command terminates. If the signal handler or another thread in the same process issues a wait(3C) call, it will interfere with the return value of pclose(). If the process's signal handler for SIGCHLD has been set to ignore the signal, pclose() will fail and errno will be set to ECHILD. EXAMPLES
Example 1: popen() example The following program will print on the standard output (see stdio(3C)) the names of files in the current directory with a .c suffix. #include <stdio.h> #include <stdlib.h> main() { char *cmd = "/usr/bin/ls *.c"; char buf[BUFSIZ]; FILE *ptr; if ((ptr = popen(cmd, "r")) != NULL) while (fgets(buf, BUFSIZ, ptr) != NULL) (void) printf("%s", buf); (void) pclose(ptr); return 0; } Example 2: system() replacement The following function can be used in a multithreaded process in place of the most common usage of the Unsafe system(3C) function: int my_system(const char *cmd) { FILE *p; if ((p = popen(cmd, "w")) == NULL) return (-1); return (pclose(p)); } ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Interface Stability |Standard | +-----------------------------+-----------------------------+ |MT-Level |Safe | +-----------------------------+-----------------------------+ SEE ALSO
ksh(1), pipe(2), fclose(3C), fopen(3C), stdio(3C), system(3C), wait(3C), waitpid(3C), wait.h(3HEAD), attributes(5), standards(5) SunOS 5.10 17 Mar 2004 popen(3C)
All times are GMT -4. The time now is 01:37 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy