title: How to both exploit buffer overflow and pass parameter to system() function in this program?
body: <p>Firstly, I sorry about unlearly question, because of my bad english, I can not discrible it clearly. I also do not know what is it? whall is it called.</p>
  
  <p>My problem below:</p>
  
  <p>I write a program by C language:</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  
  int main()  {
      char buf[2],buf1[10];
  
      fgets(buf,2,stdin);
      fgets(buf1,10,stdin);
  
      puts(buf);
      puts(buf1);
  
      printf("Opening Shell...\n");
  
      system("/bin/dash");
  
      printf("\nEND\n");
      return 0;
  }
  </code></pre>
  
  <p>My purpose is passing parameter to overflow buffer variables and inserting a command after <strong>/bin/dash</strong> to read some file that I do not own,.etc... I tried:
  <strong>pipe</strong> : </p>
  
  <pre><code>python2.7 -c 'print "a"*12 + "\n" + " -c \"cat tes.c &gt; show\""' |  /myprogram
  </code></pre>
  
  <p>My program run normally, but shellcode <code>-c "cat tes.c &gt; show"</code> maybe do not be used.</p>
  
  <p>I set all file and permission <code>7777</code>.</p>
  
  <p>So, How can I insert shellcode after <strong>/bin/dash</strong>?</p>
  
  <p>Thank for reading! Sorry for my bad english.</p>