Commit 9b395c94 authored by Lev Walkin's avatar Lev Walkin

running arbitrary commands

parent debca6c3
...@@ -12,16 +12,17 @@ ...@@ -12,16 +12,17 @@
*/ */
int int
main(int ac, char **av) { main(int ac, char **av) {
char **argv; char cmdPath[32];
char *envp[] = { NULL }; /* Empty environment */ char *envp[] = { NULL }; /* Empty environment */
int ret; int ret;
int i; int i;
if(ac < 3) { if(ac < 4) {
setgid(getgid()); setgid(getgid());
setuid(getuid()); setuid(getuid());
fprintf(stderr, fprintf(stderr,
"Usage: %s <chroot-to> <chdir-to> [options]\n", av[0]); "Usage: %s <chroot-to> <chdir-to> <command> [options]\n",
av[0]);
exit(EX_USAGE); exit(EX_USAGE);
} }
...@@ -48,20 +49,34 @@ main(int ac, char **av) { ...@@ -48,20 +49,34 @@ main(int ac, char **av) {
exit(EX_DATAERR); exit(EX_DATAERR);
} }
argv = calloc(ac + 1, sizeof(*argv));
if(argv) { /*
argv[0] = "asn1c"; * Add an argument if this is an asn1c compiler.
argv[1] = "-S/skeletons"; */
memcpy(argv + 2, av + 3, (ac - 3) * sizeof(*argv)); if(strcmp(av[3], "asn1c") == 0) {
ac -= 2;
av += 2;
av[0] = "asn1c";
av[1] = "-S/skeletons";
i = 2;
strcpy(cmdPath, "/bin/asn1c");
} else { } else {
perror("malloc()"); ac -= 3;
exit(EX_OSERR); av += 3;
i = 0;
}
if(strlen(av[0]) > sizeof(cmdPath)/2) {
fprintf(stderr, "Insecure command name: %s\n", av[0]);
exit(EX_DATAERR);
} }
memcpy(cmdPath, "/bin/", 5);
strcpy(cmdPath + 5, av[0]);
/* /*
* Check arguments for the permitted alphabet constraints. * Check arguments for the permitted alphabet constraints.
*/ */
for(i = 3; i < ac; i++) { for(; i < ac; i++) {
char *p; char *p;
for(p = av[i];; p++) { for(p = av[i];; p++) {
switch(*p) { switch(*p) {
...@@ -80,7 +95,8 @@ main(int ac, char **av) { ...@@ -80,7 +95,8 @@ main(int ac, char **av) {
} }
} }
execve("/bin/asn1c", argv, envp); execve(cmdPath, av, envp);
perror(cmdPath);
exit(EX_UNAVAILABLE); exit(EX_UNAVAILABLE);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment