I'm a wannabe

rmartine · 04-07-2003, 09:33 PM

OK.. I've been reading about a few exploits and I decided to create a simple bin that could be open to an IFS exploit. Could someone tell me what I'm doing wrong?? No matter what I set IFS to it will always run /bin/date correctly. What I'm shooting for is bin: command not found. Then I'll make a bin script to say hello or something like that.

Here is my exploitable program.

Code:

#include <stdio.h> // habit

void main()
{
   execl("/bin/date", "date", "+%D", NULL);
}

Here is my shell script to set PATH, IFS, and execute the program

Code:

#!/bin/sh
export IFS=/
export PATH=.:$PATH
/home/rmartine/bad_proggie

Any help here would be great. Thanks.

llama_meme · 04-08-2003, 04:19 AM

exec* system calls don't work through the shell, so the value of IFS doesn't affect them. Use the system(...) function instead.

Alex

rmartine · 04-08-2003, 12:38 PM

OK.. thanks. I tried using the system line but I still can't make it say

bin: command not found

Is there some protection my shell could have to prevent people from messing with IFS??

Here is my new "vulnerable code" My exploit script is above.

Code:

#include <stdlib.h>
#include <stdio.h>

int main()
{
	int returnVal;
	
	//execl("/bin/date", "date", "+%D", NULL);	
	
	returnVal = system("/bin/date +%D");
	
	return 0;
}

I changed the return type of main to make the compiler stop complaining.

revrendi · 04-08-2003, 03:42 PM

The behavior you're expecting will no longer work when you're using bash. See the mention of IFS use in http://www.gnu.org/manual/bash-2.05a...12.html#SEC129
That means bash will use IFS for things like:

/bin/bash -c 'SPLIT=1/2/3; IFS=/; for x in $SPLIT; do echo $x; done'

But it won't break up the path of a command.

rmartine · 04-08-2003, 05:50 PM

Darn.... back to the drawing board.

crabboy · 04-08-2003, 08:44 PM

It is not the objective of this site to spread or share the details of 'cracks'. Although you may consider this post to be educational; the last any legitimate Linux user wants to see is some script kiddy to run with such info and cause harm.

Gary