I was working on a challenge where I have to exploit a C program to gain elevated privileges in a linux system. To complete it I have to call a program /bin/test while the vulnerable program is running with elevated privilege level. The relevant code snippet is given below.

I was able to exploit another program which used system("cat <some file>") without a problem. In that case I created a C program with which executed /bin/test , named it cat and kept it in a directory which I later added to the $PATH variable.

However in this case I am unable to follow the above approach for two different reasons.

  1. I am unable to locate the binary for export command.
  2. I am unable to create a $PATH variable which will call my custom file command as the full path is being called in the system() of the program to be exploited.
  3. Also note that the program sanitizes semicolon and a couple of special characters which makes it difficult to append multiple commands in the system call.
  • export is not a binary on the filesystem, but a shell built-in. You should probably read on that and anything else that you find unknown. – domen Oct 10 '16 at 12:44

I have compiled the program and I can execute the "id" command by providing


as arg on stdin. Looks like they missed the backtick as forbidden character. Maybe you can create a sh script that creates a root user...

  • You are a life saver @kaidentity. I am dumb. I shouldn't have forgotten about backtick – hax Oct 10 '16 at 14:05
  • Actually, I shouldn't have told you ;-) I'm a big fan of the OSCP, my reply should've been "try harder!" – kaidentity Oct 10 '16 at 14:12
  • Oh! is this one from the OSCP? I didn't know that. I was doing this as part of a Unix System Security class. – hax Oct 10 '16 at 14:25
  • No, it is not, but this exercise is very typical and none would've had helped you ;-) Anyway, good luck with your exercises. – kaidentity Oct 10 '16 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.