【pwnable.kr】cmd2

这道题是上一个cmd1的升级版

ssh cmd2@pwnable.kr -p2222 (pw:mommy now I get what PATH environmentis for :))

登录之后，还是审计一下源代码：

#include <stdio.h>

#include <string.h>

int filter(char* cmd){

    int r=;

    r += strstr(cmd, "=")!=;

    r += strstr(cmd, "PATH")!=;

    r += strstr(cmd, "export")!=;

    r += strstr(cmd, "/")!=;

    r += strstr(cmd, "`")!=;

    r += strstr(cmd, "flag")!=;

    return r;

}

extern char** environ;

void delete_env(){

    char** p;

    for(p=environ; *p; p++)    memset(*p, , strlen(*p));

}

int main(int argc, char* argv[], char** envp){

    delete_env();

    putenv("PATH=/no_command_execution_until_you_become_a_hacker");

    if(filter(argv[])) return ;

    printf("%s\n", argv[]);

    system( argv[] );

    return ;

}