c - Is a Command injection possible in the arg parameter of execve -


my program uses excve run ls, , second argument filled user :

  char * envp[1] = { 0 };    execve(my_command, user_input, envp); 

is possible user inject command in user_input parameter though considered argument?

i tried running $( interpreted before :

./my_program.out "$(cat /etc/passwd)" 

is there way escape $ still inject command?

no can't inject commands unless there vulnerability inside ls.

see http://linux.die.net/man/2/execve

the argument vector , environment can accessed called program's main function, when defined as: int main(int argc, char *argv[], char *envp[])


Comments

Popular posts from this blog

android - MPAndroidChart - How to add Annotations or images to the chart -

javascript - Add class to another page attribute using URL id - Jquery -

firefox - Where is 'webgl.osmesalib' parameter? -