How do I provide stdin inputs from command line?

c security penetration-testing stack-smash
Lord Loh. picture Lord Loh. · Jul 27, 2011 · Viewed 9.5k times · Source

I am trying to perform a buffer overflow attack on a program for a class assignment. Both the attack program as well as the vulnerable programme is written by me.

The vulnerable code uses scanf to read data from stdin.

./vulnerable < malicious_payload_file.txt works fine. more malicious_payload | ./vulnerable and echo JUNK_JUNK_JUNK_JUNK | ./vulnerable also works as expected.

However, i would like to use the attack programme to keep supplying incrementally longer payloads till the programme crashes. So, I need to dynamically generate larger payloads of junks. I am using system ("./vulnerable"); to repeatedly call and test for an abnormal exit.

How do I specify such a payload?

Is there a way to run ./vulnerable < malicious_payload_binary or in some manner such that I do not have to put the malicious payload in a file, but can specify it in the command line?

Answer

Susam Pal picture Susam Pal · Jul 27, 2011

How about this?

echo "your payload goes here" | ./vulnerable

You can replace the echo command with any command that generates the input to ./vulnerable you want. One such example is a constant flow of junk as input, you can do this:

cat /dev/urandom | ./vulnerable

Related questions

C - The %x format specifier

I have a small question. I know that the %x format specifier can be used to read values from the stack in a format string attack. I found the following code: %08x%08x%08x%08x What does the 08 mean? What …

Read More
How can a Format-String vulnerability be exploited?

I was reading about vulnerabilities in code and came across this Format-String Vulnerability. Wikipedia says: Format string bugs most commonly appear when a programmer wishes to print a string containing user supplied data. The programmer may mistakenly write printf(buffer) …

Read More
Which of sprintf/snprintf is more secure?

I wish to know which of these two options is the more secure one to use: #define MAXLEN 255 char buff[MAXLEN + 1] sprintf(buff, "%.*s", MAXLEN, name) snprintf(buff, MAXLEN, "%s", name) My understanding is that both are same. Please suggest.

Read More