Hi all, I am a newbie to command scripting and trying to perfect it. I was reading an introduction to computer security book that I found in the library and was trying out the tutorial. However being a noob, I am stuck with two of the questions and would like to humbly seek help from the community.

Q1.Write an attack script or a program to list the content of the directory /home/alice/Private/ where Alice is a super user. The attack must work when executed by user charlie (non super user). If your program/script works correctly, it should show something that looks like the output of a ‘ls –l’ command,

Below is my code:

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
int main(void)
{
system("cd ./home/alice/Public; ./mysecret ';ls -l /home/alice/Private;'");

}


Q2. Write a script/program to display the application password and the secret of the admin user.

Solution: This question I really do not even know how to start

Just F.Y.I, this is not some homework os school assignment. I am too old for that. It's just something I want to pick up and learn and hope I can make new friend from the linux community. Thanks

Do you really think it's a good idea to publish the code for attack scripts? I don't know the answer to your queries but if I did, I would really not care to place them on a publicly viewable forum.
jdk

1 members found this post helpful.

What you are writing is not a command script, but a C program.

This won't work, since there is no program named "cd".
You can however use the chdir() system call prior to calling system():
The problem is that Charlie is unlikely to have the right permissions to cd to Alice's home directory.
Also, I don't know what "mysecret" is supposed to accomplish and I find the parameter to "mysecret" very strange - why does it start with a semicolon?

Neither do I, as I am utterly lacking context; what are the application and the secret mentioned in the question?

[Moderator note: I've moved the question to Linux-Security. This forum is better for that kind of questions]

Hi Jdkaye, it's for practice on my understanding of the various access control and how to access them.
Hi bernadbauch, thanks a million for your help. Yes you are right, it's a C program and not a command script. The first question is to write a C program to access the private directories of the privileged user from the directory of a normal user with no privilege access. mySecret is the executable that is generated by a program stored in the private directory of the privilege user.

As for the second question, I am suppose to write a script to access the application password that is stored in the private directory of the privilege user. Thanks for your help once again.

Sure thanks Mara. I am lacking practice.