Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
For educational reasons I have to exploit an C-Code
The Programm set the egid first, and then the vulnerability with the system("/usr/bin/..."); Command.
So I made an ‘usr’ executeable in my Home-Directory and set the Path to the Home PATH=$HOME:$PATH
And I want to change the IFS Variable in the bash to /: export IFS='/'
Unfortunatelly, when i call the C-Programm: my exploit doesn’t work
Is anybody able to tell me what is wrong?
I suppose we are studying at the same university, because I am currently confronted with the same problem. I don’t want to give you the whole solution, because that would be too easy =)
Your IFS variable is not ignored, but it doesn’t work as you might think. When you call the C-Programm there is an additional output in the shell, which refers to the lesspipe. With the information in this link and this german link you are able to solve the challenge1 😉