> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/02.-command-injection-in-binary-exploitation/challenge/hard/solution.md). # Solution image image This challenge was a layered command injection exercise built around a “network pinger” program that unsafely passed user input into a shell via `system()`. Initially, the injection was straightforward: by entering characters like `$(pwd)` or similar command substitution, it was confirmed that user input was being executed by the shell, proving the vulnerability existed. However, early attempts to read the flag failed because the target file `/root/flag.txt` was protected by Linux permissions, and the program was running as a normal user, which resulted in “Permission denied” when trying to access it directly. As the challenge progressed, additional restrictions were introduced. Characters like semicolons, pipes, and spaces were either blocked or unreliable in execution, forcing the use of shell features like command substitution and input redirection. Attempts using `${IFS}` to bypass space filtering initially failed due to improper shell parsing in the wrapped `system()` environment, which caused malformed commands and broken redirections such as `/tmp/out` not being created correctly. This highlighted how restricted shells can behave unexpectedly when injecting complex payloads. The turning point came when privilege context changed after switching to root using `sudo su`. Once the program was executed as root, the same injection payload suddenly became effective because the permission barrier was removed. The command substitution `$(cat/tmp/out)` executed successfully, reading the protected file and writing its contents into `/tmp/out`. Since the program suppressed output, the only reliable exfiltration method was writing to a file and reading it afterward manually. Ultimately, the challenge demonstrated three key concepts: detecting command injection through shell execution behavior, dealing with filtering and parsing limitations in constrained environments, and understanding how privilege context determines whether an exploit succeeds or fails. The final success was not due to a more complex payload, but due to executing the same injection under a root context where file access restrictions no longer applied. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/02.-command-injection-in-binary-exploitation/challenge/hard/solution.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.