Unable to load image

Any C hackers in here 👀👀

Just curious, and I haven't googled because I already know it's not going to answer the question ....

So say hypothetically I launch an API to run in-line C code from the terminal. It'd just be a basic shell script that has a skeleton of a .c file and injects STDIN straight into the main function. The only header would be <stdio.h> Is it possible to do this securely? Or is the simply allowing arbitrary C even with these restrictions a recipe for pwnage.


So it'd be just

In the endpoint directory:

index.php
run.sh

index.php would receive the string and call shell to remove comments

:a;s@//.*@@;ta; :a;s@/\*@@;ta; :a;s@\*/@@;ta;

then it would just echo out

#include <stdio.h>
int main(void) {

**

<<user input>>

**

return 0; }

into a temporary.c , compile, and then php can capture the output into a variable and with that reply to the API call.

I'm gonna do this anyway on a throwaway server but I was wondering mostly out of curiosity whether even this can be exploited. (i.e. somehow adding more headers and executing a fork bomb or something)

19
Jump in the discussion.

No email address required.

:#marseysanta3:

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.