Hacker News new | past | comments | ask | show | jobs | submit login

if you're going to insert a shell code into printf, then well... you can implement anything in printf... or in memcpy.. or in strcat.. or whatever really.



Heck, why not just title it "a web server with no library function calls" and call an array of bytes as a function? Then everybody would be able to see what it really is, which is an unremarkable shellcode embedded directly in a C program. I feel like the "printf" was only included so that people would have something to recognize in the title.


By that logic you could just execve httpd with shellcode. Or ruby. Or a ruby program that generates a perl script that compiles a Prolog program to shellcode that looks like it prints hello world, but actually does execve httpd.


Yes, he mentions that.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: