Linux API system()安全性问题

左手的ㄟ右手 2023-02-23 12:14 4阅读 0赞

Use of the system() function can result in exploitable vulnerabilities, in the worst case allowing execution of arbitrary system commands. Situations in which calls to system()have high risk include the following:

1.  When passing an unsanitized or improperly sanitized command string originating from a tainted source
2.  If a command is specified without a path name and the command processor path name resolution mechanism is accessible to an attacker
3.  If a relative path to an executable is specified and control over the current working directory is accessible to an attacker
4.  If the specified executable program can be spoofed by an attacker

## system()实现 ##

system() 实现是通过fork和execv实现，详细code如下:  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzUxNDY1_size_16_color_FFFFFF_t_70]

## 安全性 ##

从上面code可以看出，安全性主要体现在shell执行上特性。  
1、shell 可以运行不止一条cmd (通过；)，容易被利用  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzUxNDY1_size_16_color_FFFFFF_t_70 1]  
2、shell 有些命令的运行结果依赖环境变量  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzUxNDY1_size_16_color_FFFFFF_t_70 2]

## 参考url ##

https://stackoverflow.com/questions/43197676/is-system-call-in-c-program-safe/43197711  
https://stackoverflow.com/questions/48069989/are-all-system-calls-a-security-risk-in-c  
https://wiki.sei.cmu.edu/confluence/plugins/servlet/mobile\#content/view/2130132  
https://stackoverflow.com/questions/27461936/system-vs-execve

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzUxNDY1_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200707150601104.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzUxNDY1,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzUxNDY1_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/2020070720532389.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzUxNDY1,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzUxNDY1_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200707205341970.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI4MzUxNDY1,size_16,color_FFFFFF,t_70