I was working on a challenge where I have to exploit a C program to gain elevated privileges in a linux system. To complete it I have to call a program
/bin/test while the vulnerable program is running with elevated privilege level. The relevant code snippet is given below.
I was able to exploit another program which used
system("cat <some file>") without a problem. In that case I created a C program with which executed
/bin/test , named it cat and kept it in a directory which I later added to the
However in this case I am unable to follow the above approach for two different reasons.
- I am unable to locate the binary for
- I am unable to create a
$PATHvariable which will call my custom
filecommand as the full path is being called in the
system()of the program to be exploited.
- Also note that the program sanitizes semicolon and a couple of special characters which makes it difficult to append multiple commands in the system call.