System(), any other way?

Is there any other way to execute a command without using system() like because system() uses the command prompt to execute the thing but i dont want to do that.

Code:

#include <iostream>
#include <windows.h>

int main()
{
    char TheThingYouWantToDo[NULL];
    std::cout<<"What cha wanna do fool:";
    std::cin>>TheThingYouWantToDo;
    system(TheThingYouWantToDo);
    return 0;
}

On windows you can use ShellExecuteEx or CreateProcess.

CreateProcess() has an option to create the new process without a window. Don't know is ShellExecuteEx() can do that or not.

ShellExecuteEx will give the app a console if it's a console app.

>> char TheThingYouWantToDo[NULL];

BTW, this won't work. You have a 0 sized array that you are trying to read data into from cin.

it lets me in DEV-C++ and i did it so i can bufferoverflow if i want

Ok, maybe it might "work" in some situations, but it is wrong. Besides, you could put 999 in there instead of NULL and it would be less typing and much closer to correct, so why would you use NULL?

Originally Posted by bikr692002

it lets me in DEV-C++ and i did it so i can bufferoverflow if i want

You can make a program that could crash and or loose data if you want.
I wonder if the compiler allocates the allignment setting or else what would such a structure's address be.

There's an FAQ entry on the subject.

[edit]
Here it is.
[/edit]

bikr692002,

in windows, you can use WinExec() too

jmgk

WinExec is 16-bit legacy and deprecated. Don't use it.

Originally Posted by Daved

Ok, maybe it might "work" in some situations, but it is wrong. Besides, you could put 999 in there instead of NULL and it would be less typing and much closer to correct, so why would you use NULL?

So then like if someone typed in a 14 character command it would only take 14 blocks and if someone typed 20 then it would take 20 blocks, at elast thats what i think, i'm a little new

That code is illegal. It will often lead to a crash (you are accessing memory that doesn't "belong" to you). It is also not smart to try and save space like that. It is rarely necessary, and of course having your program crash or having somebody hack your program to do bad things is much worse than a tiny amount of wasted memory.

If you're concerned about the wasted memory, you could use the string class, which usually starts with a small amount of allocated memory and then grows as needed based on the size of the data entered by the user.

I want to exploit it myself though, in my schools network to gain admin access someway or to execute commands, well this is what i have so far

Code:

#include <windows.h>
#include <iostream>

int main()
{
    char szPath[] ="C:\\WINDOWS\\SYSTEM32\\MSG.EXE";
    char CommandString[NULL];
    
    std::cout<<"Please enter command argument:";
    std::cin>>CommandString;
    
    PROCESS_INFORMATION pif;
    
    STARTUPINFO si;
    
    ZeroMemory(&si,sizeof(si));
    si.cb=sizeof(si);
    
    BOOL bRet=CreateProcess(
                        szPath,
                        CommandString,
                        NULL,
                        NULL,
                        FALSE,
                        0,
                        NULL,
                        NULL,
                        &si,
                        &pif);
    if (bRet==FALSE)
    {
        MessageBox(HWND_DESKTOP,"Unable to start program","Error",MB_OK);
        return 1;
    }
    
    CloseHandle(pif.hProcess);
    CloseHandle(pif.hThread);
    return 0;
}

thanks for the FAQ dwks but this isnt working for some reason

Originally Posted by bikr692002

I want to exploit it myself though ...
thanks for the FAQ dwks but this isnt working for some reason

If you had read and understood previous posts you would know why that program doesn't work. char CommandString[NULL]; is a character array of 0 length and any attempt to put something in that array will fail. Add this line and you will see how many bytes that character array has (which is 0)

Code:

    std::cout << "sizeof(ComandString) = " << sizeof(CommandString) << std::endl;