Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
48

Is it possible for an attacker, regardless of how unlikely it would be, to exploit this somehow by modifying the content of attackerControlledFile.txt? "Somehow" refers to things like: This code requires the output to be printed onto a specific terminal emulator In fact, yes. Old terminals like vt100 have the ability to use ANSI escape sequences to do ...


28

A call to fopen is not in itself a TOCTOU vulnerability. By definition, TOCTOU involves two operations: a “check” and a “use”. A common example of TOCTOU vulnerability is checking access permissions with access before opening a file. It's a bug (race condition) because the permissions might change between checking and opening, and it's usually a ...


12

If the output is going to a terminal, you have potentially lots of problems (regardless of how you print it, unless you strip special characters), as per other answers. If the file can be gigantic, the attacker can make bash use a lot of RAM. Consider head -c 100000 instead of cat to set an upper limit of 100kB. Or head -c 10000 | cat -v (show non-...


4

Some terminals can echo back screen content as-if typed. Thus you can possibly force "typing" and thus command execution with the right terminal commands. I have done this on physical DEC VT62-ts. but have not tried to do it with the VT-52 mode of X-term this exploit is well known, and is probably the reason why finger -l username strips all control ...


3

Your question does not distinguish between administrative privileges, and "highest privileges possible". Where to go when you have elevated privileges? "Elevated privileges" are not the highest you can go. Even though you might be administrator, the operating system kernel can still deny you access to some resources or to perform some actions. Furthermore, ...


2

No, echo used in the example above is fine Echo simply prints a string to the pipe stdout (default) per: https://superuser.com/a/699500/527937 Pipes can't overflow. A pipe is just a buffer (a certain amount of memory, most likely 64KB on a current system) between a producer and a consumer. If the producer produces faster than the consumer consumes, ...


1

"... Remote Desktop Protocol ... Microsoft advises to disable it until the latest patches have been applied..." https://en.m.wikipedia.org/wiki/BlueKeep


1

Why are you using %00 at the end of your input? You're getting it "free" :) from the code itself in the . ".php" part I'm guessing that the challenge is not in PHP7, since you can't terminate strings like that any more. Anyway, using the payload ../etc/config (without null - %00) works for me: However, maybe my setup is wrong: /opt/lampp/htdocs/project/...


1

In order to perform a vulnerability assessment you first need an inventory of what you are assessing. Reverse ip lookups for dns entries are one way to start building that inventory.


Only top voted, non community-wiki answers of a minimum length are eligible