+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: The Lounge (https://sinister.ly/Forum-The-Lounge)
+--- Thread: "hack this site" concept (/Thread-hack-this-site-concept)
"hack this site" concept - phyrrus9 - 01-03-2015
Okay, so I was thinking about starting a little game. For now, awards will be stated in each contest.
Rules:
Code:
I will post a full program, and your task is to break it. This will not only test your ability to spot security flaws, but also help the community by teaching them how to prevent certain flaws.
You will need to explain why your method works in some way. This could be as simple as "buffer overflow on the stack enables arbitrary code execution" if it is true, or as complex as "a buffer overflow exists when initial arguments are longer than 0x100 bytes, causing the variable buf0 on the stack to overflow into the return address for function getline(char *) allowing the attacker to bypass a call to the sanity check function and allowing code to be executed on the command line and relaunch the program with an injected library, removing the sanity check altogether"
You MUST post your entire solution, including any extra code written and tools used.
The solution will be verified before correctness is confirmedSo, here goes the first challenge:
Spoiler:
Reward: +2 rep
Challenge: modify the program during runtime to allow any command to be executed.
Code:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
char isSane(char *buf)
{
if (strstr(buf, "..") != NULL) return 0;
if (strstr(buf, "./") != buf) return 0;
return 1;
}
void getLine(char *buf)
{
int i = 0;
char c;
do
{
c = getchar();
buf[i++] = c;
buf[i] = 0;
} while (c != '\n');
}
int main()
{
char *buf = malloc(0x200);
for (;;)
{
getLine(buf);
if (isSane(buf)) system((const char *)buf);
}
}