OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Masaru Matsunami (mat_at_abelia.ocn.ne.jp)
Date: Thu Jul 18 2002 - 12:19:54 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Hi.

    Wed, 17 Jul 2002 22:03:29 -0500
    b0iler <b0ilereyeonsecurity.net> wrote:

    > I know open(), but how can sysopen() be used to call a shell? If you cane
    > xplain this in as great detail as possible.

    I want to know, too :)

    > glob() from my understanding is fairly harmless. AFAIK it cannot call
    > commands, just does "globbing" (completing queries with * ? [0-9] etc..).
    > Unless I am missing a way inwhich it can be used it should always require
    > another function to actually issue the commands. Explain this one from
    > scratch if possible.

    I think it depend on version of Perl.
    My test environment has 2 different version of Perls.
    The following is my test result, that says
    version 5.005_03 allows glob to invoke shell,
    but version 5.6.1 does not allow.

    # /usr/bin/perl -v | grep This
    This is perl, version 5.005_03 built for i386-linux
    # ls /tmp/g*
    ls: /tmp/g*: No such file or directory
    # /usr/bin/perl
    files=<*.h; /bin/touch /tmp/glob_test_1>;
    # ls /tmp/g*
    /tmp/glob_test_1
    # /usr/local/bin/perl -v | grep This
    This is perl, v5.6.1 built for i686-linux
    # /usr/local/bin/perl
    files=<*.h; /bin/touch /tmp/glob_test_2>;
    # ls /tmp/g*
    /tmp/glob_test_1
    #

    -- 
    Masaru Matsunami <matabelia.ocn.ne.jp>