I think you've missed the point of this question. Given the wording of the question, the person who set the exam might not have been very clear on the threat model, unless there's some additional introduction material for this question that you didn't quote and that provides more context.
What you posted is a program which takes one argument, a string, and executes this string as a shell (
The key point is in what context this program is called. There are plenty of programs that execute their argument as a shell program or as an external command, starting with
If the program is called in the same security boundary as the entity that decides the argument, there is no security implication since no security barrier is crossed.
If the argument is chosen by an entity outside the security boundary that runs the program (for example, if the program is executed with extra privileges through
sudo, or if the argument is read from an external user over the network), then this is a trivial injection. There's no need to be creative: you can put absolutely any code you like in there (you just need to express it in shell syntax). You can access all the files of the user who is running the program, modify them and add new ones, execute whatever programs you want, make use of any available network connection, etc.
Whenever you can execute arbitrary code in a privileged context, you've won.
rm -rf / is actually not going to work unless the program is running as root on a system which doesn't have ad hoc
rm -rf / prevention. Something like
rm -rf ~ (remove all the files in the user's home) would be more useful if you want to cause harm. But usually attackers are after more productive things, such as reading the files stored on this account or the databases that it has access to, planting a backdoor to be able to regain access later, sending spam or generating bitcoins, and so on.