How to pass \x00 as argument to program?

shell command-line shellcode
Hrishikesh Murali picture Hrishikesh Murali · Sep 6, 2011 · Viewed 8.5k times · Source

I have a small program where I wish to pass shellcode as argument. In the shellcode, there is a necessity to pass \x00. I tried the following command:

./program `python -c 'print "\x01\x00\x00\x00\x9c\xd8\xff\xbf"'`

But the \x00 doesn't get registered at all! The arguments passed to the program are "\x01\x9c\xff\xbf".

I don't think it's a problem with python, but rather with the shell which passes the argument. I am using the bash shell.

Now, how do I force the shell to pass the argument '\x00'?

Thanks and Regards,
Hrishikesh Murali

Answer

Christopher Creutzig picture Christopher Creutzig · Sep 6, 2011

Not at all. Unix uses C-style strings for the arguments a command is invoked with, and they are NUL-terminated character sequences.

What you can do is to rewrite your program (or find an invocation variant) to accept the parameter in its standard input. NUL bytes work just fine there and are, in fact, widely used, typically as separators for file names, since they are pretty much the only thing a file name can never contain. See find's -print0 switch and xarg's switch -0 for the arguably most popular examples.

Related questions

How do I copy a folder from remote to local using scp?

How do I copy a folder from remote to local host using scp? I use ssh to log in my server. Then, I would like to copy the remote folder foo to local /home/user/Desktop. How do I achieve …

Read More
How do I set a variable to the output of a command in Bash?

I have a pretty simple script that is something like the following: #!/bin/bash VAR1="$1" MOREF='sudo run command against $VAR1 | grep name | cut -c7-' echo $MOREF When I run this script from the command line and pass it …

Read More
How to reload .bash_profile from the command line?

How can I reload .bash_profile from the command line? I can get the shell to recognize changes to .bash_profile by exiting and logging back in but I would like to be able to do it on demand.

Read More