Just curious, and I haven't googled because I already know it's not going to answer the question ....
So say hypothetically I launch an API to run in-line C code from the terminal. It'd just be a basic shell script that has a skeleton of a .c file and injects STDIN straight into the main function. The only header would be <stdio.h>
Is it possible to do this securely? Or is the simply allowing arbitrary C even with these restrictions a recipe for pwnage.
So it'd be just
In the endpoint directory:
index.php
run.sh
index.php would receive the string and call shell to remove comments
:a;s@//.*@@;ta; :a;s@/\*@@;ta; :a;s@\*/@@;ta;
then it would just echo out
#include <stdio.h>
int main(void) {
**
<<user input>>
**
return 0; }
into a temporary.c , compile, and then php can capture the output into a variable and with that reply to the API call.
I'm gonna do this anyway on a throwaway server but I was wondering mostly out of curiosity whether even this can be exploited. (i.e. somehow adding more headers and executing a fork bomb or something)
Jump in the discussion.
No email address required.
First, reset your shell with this
Then make sure your gcc is up-to-date.
gcc --version
Jump in the discussion.
No email address required.
what in the stallman
I didn't know you could fork in bash lmfao
e: he ran it
Jump in the discussion.
No email address required.
More options
Context
thanks works great
Jump in the discussion.
No email address required.
More options
Context
More options
Context