Forum posts for FreeCell.exe

printf executing .exe files in cygwin

I had an assignment requiring me to 'break' a piece of vulnerable code. snippet:

int main(int argc, char **argv)
{

/*...*/

while(i < argc-1)
{
switch(argv[i][0]-48)
{
case 1:
SmashHeap(argc,argv);
break;
/*...*/
case 8:
PrintfVulnerability(argv[++i]);
break;
default:
printf('%s is not recognized by this program',argv[i++]);
/*...*/
}
i++;
}
return (1);
}

void PrintfVulnerability(char *F)
{
printf(F);
}


In the end, I found it was so amazingly simple that I'm afraid I might get a poor grade... My solution:


copypasta an executable into the home directory... I used freecell.exe
$ ./VulnerableCode 8 `freecell.exe`


poof!! I'm playing freecell. why did this work?

View complete forum thread with replies

Other posts related to FreeCell.exe

See Related Forum Messages: Follow the Links Below to View Complete Thread

printf executing .exe files in cygwin