Vulnerability Development mailing list archives

Problem with keyboard forwarding to cmd.exe shellcode


From: "Berend-Jan Wever" <skylined () edup tudelft nl>
Date: Tue, 14 Sep 2004 12:46:01 +0200

Hi guys,

I'm working on a "shellcode client" that'll forward I/O to a cmd.exe shellcode on a remote computer. I ran into two 
problems:
- To forward ^C and ^Z, I'm catching interrupt and terminal stop signals and send a 0x03 or 0x1A respectively. This 
doesn't seem to work: if you'd type "copy con file.txt", you're doomed because neither the ^C nor the ^Z will break the 
command.
- Turning off buffering on stdin doesn't work like I would expect it to, does anybody know how to do this properly ? 
(see the code below)
babyjee@papa:~/prg/tools/w32_cmdftp$ ./test
abc
[61][62][63][0a]
babyjee@papa:~/prg/tools/w32_cmdftp$

---start test.c---
#include <stdio.h>
#include <stdlib.h>

int main() {
  int byte;

  if (setvbuf(stdin, NULL, _IONBF, 0) != 0) {
    perror("Cannot remove buffering from stdin");
    exit(EXIT_FAILURE);
  }

  do {
    fprintf(stdout, "[%02x]", byte=getchar());
    fflush(stdout);
  } while (byte != '\n');

  fprintf(stdout, "\n");
  exit(EXIT_SUCCESS);
}

---end test.c---


Current thread: