HC's Capture the Flag website
CTF Contests
25C3-CTF
25C3-CTF final results
Advisory #120
From team OpenTU
New advisory by : anonymous coward
Affected service(s): goffer
Severity [lmh] : low
===== Problem =====
Goffer uses a shell script "ls" in place of the normal /bin/ls. Normally, this shell script only executes /bin/ls, but an attacker might get access to the file and change it, thereby allowing arbitrary command execution.
===== Impact =====
Arbitrary command execution.
===== Fix =====
In line 22 of goferdee.lol, replace
"." N "/"
with
"/bin/"
Rating
[0] too late