Working with the Unix OS

Unix Security
system(cmdstr);
$ echo "/bin/cat /etc/private" > ed
$ chmod +x ed
$ PATH=":"; export PATH
$ smart idiot
/* always specify full pathname */
system("/bin/ed"):
/* or specify path */
system("PATH=/bin:/usr/bin:/etc ed");
$ cp ed bin
$ PATH=: IFS=/ smarter idiot
/* solution */
system("IFS=' \t\n'; export IFS: /bin/ed");
system("IFS=' \t\n'; export IFS; PATH=/bin:/usr/bin:/etc ed");
$ smarter "idiot; cat /etc/private"
/* check argv[l] for special shell characters */
if (strpbrk(argv[l], "|^;&'*?[]$/\\'\"\n") != (char *) NULL)
{
fprintf(stderr, "smartest: bad character in argument\n"):
exit(2);
}
! Shell Escapes
saveeuid = geteuid();
setuid(getuid());
system("/bin/ed") ;
setuid(saveeuid):
! Executing SUID programs from inside SUID programs
When you run a SUID program from inside a SUID program the new program runs with the effective UID of its
owner. "mkdir" & "rmdir" commands are SUID and owned by root.
$ cat mkrmdir. c
main ()
{
system("/bin/mkdir foo");
system("/bin/rmdir foo");
}
$ ls -l mkrmdir
-rwsr-xr-x 1 pat ITB100 2048 May 26 17:01 mkrmdir
$ ls -ld
drwxr-xr-x 2 pat ITB100 320 May 26 17:02 .
$ who am i
greg tty08 May 26 17:05
$ mkrmdir
mkdir: cannot access.
rmdir: foo non-existent
$ su pat
Password: XXXX
$ id
207