lkml.org 
[lkml]   [1998]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: Directory name problem...
25-Oct-98 20:01 you wrote:
> Hi Michael.

>>> % Already tried, and he's not interested, but I did find out what script
>>> % he's using...
>>> %
>>> % Q> #!/bin/sh
>>> % Q> XYZZY="`find / -name core`"
>>> % Q> for LOOP in `find $XYZZY | sort -ru` ; do
>>> % Q> rm -fr $LOOP
>>> % Q> done

>> You have GOT to be kidding me!?!?!

> Crazy as it sounds, nope...

>> Oh beautiful! How about this instead... If you know the name
>> of the script (say /usr/local/stupid_BOFH_admin/rmcore) then use this
>> instead:

>> mkdir -p "BOFH /usr/local/stupid_BOFH_admin/rmcore /core"

>> Or how about this:

>> mkdir -p '"BOFH | chmod 666 /etc/passwd" /core'

>> Or...

>> mkdir -p '"BOFH ; chmod 666 /etc/passwd" /core'

>> Watch precise quoting carefully. That make take a little fine
>> tuning but you get the point...

> How about...

Guys, please try to avoid showing your BAD script-writers knowledge when you
criticize sripts written by others. Of course this script will allow you to
remove [almost] any file in system, but this script WILL NOT ALLOW you to
execute command from root. Why ? You are joking ? You are really could not
understood ? Ok. Take a look:
-- cut --
++ find / -name core
+ XYZZY=/tmp/"BOFH | chmod 666 /etc/passwd" /core
++ find '/tmp/"BOFH' '|' chmod 666 '/etc/passwd"' /core
find: /tmp/"BOFH: No such file or directory
find: |: No such file or directory
find: chmod: No such file or directory
find: 666: No such file or directory
find: /etc/passwd": No such file or directory
find: /core: No such file or directory
++ sort -ru
-- cut --

See ? All metacharacters are correctly hided by bash ... Not in XYZZY= line
though, but this is minor error in "set -x"... So all you commands will not
be executed... But you still could remove any file on your choice :-)) This
should be enough...


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:45    [W:0.114 / U:0.432 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site