New answers tagged c
I don't think that it is possible to detect the compilation date/time/timezone until and unless the malware has specified it inside explicitly. The time reported by Kaspersky must be the Date/Time/TimeZone when the first threat of such malware was reported to the Kaspersky Virus Database.
Yyour buffer is too small to fit shell code + return address. Make it a bit larger if you plan to test the concept. Also, you can put the shellcode in the ENV.
The minimum you need to do is to ensure that .. is never used as a path component. It is enough to check that: The requested path begins with /. (If it doesn't, you may want to either reject it or forcibly prepend / before doing the next check.) The requested path does not contain the substring /../. The requested path does not end with the suffix /... ...
C is a fraught language for doing security-related string manipulation. But presumably you have no choice. If you need to support unicode, then I'd recommend using an appropriate library for it. Otherwise (as this is a school project) I would suggest simply rejecting any requests that aren't limited to 7-bit ascii. So that's (uchar) c > 127 for any ...
This is a deceptively simple question as it boils down to how can paths be be abused. I for one don't claim to know how many ways they can be abused because there are many. Some of them are platform specific and there was no platform mentioned. You aren't doing any matching of paths for access control, passing off control to different handlers based on the ...
Approach it as a mapping from "what the user should be allowed to do" to "files on the server." Checking that they cannot go "up" a directory is one example of a limitation on the mapping: it assumes that the server configuration has designated a "safe" folder, such that all files in that folder, recursively, are safe. Everything else is very dependent on ...
Top 50 recent answers are included