3 ms·
if you're going to insert a shell code into printf, then well... you can implement anything in printf... or in memcpy.. or in strcat.. or whatever really.
by zobzu 13y ago
if you're going to insert a shell code into printf, then well... you can implement anything in printf... or in memcpy.. or in strcat.. or whatever really.
- kang 13y agoYes, he mentions that.
- yalue 13y agoHeck, why not just title it "a web server with no library function calls" and call an array of bytes as a function? Then everybody would be able to see what it really is, which is an unremarkable shellcode embedded directly in a C program. I feel like the "printf" was only included so that people would have something to recognize in the title.
- anon4 13y agoBy that logic you could just execve httpd with shellcode. Or ruby. Or a ruby program that generates a perl script that compiles a Prolog program to shellcode that looks like it prints hello world, but actually does execve httpd.