# Pwn4
We're given a program. Let's see what it does.
![](https://raw.githubusercontent.com/shawnduong/ctf-writeups/master/2019-TAMU/images/pwn4-1.png)
Look like it's executing the `ls` command, passing whatever arguments go into it.
This is a classic command injection attack. We can simply just inject our command by passing `&&` followed by our command, meaning "execute this command, AND the one following it."
Let's run this attack on the live server copy of the program.
![](https://raw.githubusercontent.com/shawnduong/ctf-writeups/master/2019-TAMU/images/pwn4-2.png)