Send shellcode to interactive C program in Windows

Question

I'm trying to exploit a buffer overflow vulnerability in a C program, I have control of EIP but I don't know how to send the payload to the program. Here's the source:

#include <cstdio>

int main() {
    char name[32];
    printf("Enter your name and press ENTER\n");
    scanf("%s", name);
    printf("Hi, %s!\n", name);
    return 0;
}

How can I insert the payload (BUFF + EIP + NOPs + Shellcode) in the name variable? In Linux its some like $(python -c 'print "BUFF + EIP + NOPs + Shellcode') how can I do this in windows? If possible with a python script.

Thanks.

Ajay Brahmakshatriya · Accepted Answer · 2017-03-24 11:25:56Z

2

If pipe functionality is not available, you can use a temporary file to pipe the payload.

As

python -c 'print "BUFF + EIP + NOPs + Shellcode' > payload.txt
vulnbrable_binary.exe < payload.txt

answered Mar 24, 2017 at 11:25

Ajay Brahmakshatriya

9,3403 gold badges31 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

11 Comments

Bob_Backer Over a year ago

Thank you, I can do it in cmd.exe however in Immunity passing < payload.txt as an argument doesn't work.

Ajay Brahmakshatriya Over a year ago

In that case you can start the process externally from cmd and then attach immunity to it.

Ajay Brahmakshatriya Over a year ago

Also while selecting files to run with immunity you can specify command line arguments. You can try giving < payload.txt there

Bob_Backer Over a year ago

If I use vulnbrable_binary.exe < payload.txt the program terminates before I can attach it in Immunity

Bob_Backer Over a year ago

For this exercise I have the source code however I need to get a working solution for when the source is not available. Thank you for all your help.

|

Collectives™ on Stack Overflow

Send shellcode to interactive C program in Windows

1 Answer 1

11 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

11 Comments

Your Answer

Sign up or log in

Post as a guest

Related