September 01, 2017

pwnable.kr cmd1 solution


Mommy! what is PATH environment in Linux?





There is "cmd1" and "cmd.c". The cmd1 program changes PATH environment, blocks keywords which is "flag", "sh", "tmp", executes the parameter "argv[1]".





Because of the changing PATH, absolute path is needed to execute something.





There are two ways I checked.
1. Read the "flag" file with wildcard strings.
2. Read the "flag" file with soft-links.

FYI.
Initially, I thought that the current path(.) should be in the PATH environment variable in order to treat fg_tt as a relative path. But it was wrong. relative file path is available without registering current(.) path(Like above image). The reason is here(Link)