Using a Single system() Call to Execute Multiple Commands in C

c security system exploit
Chance picture Chance · Oct 29, 2008 · Viewed 21.9k times · Source

In an information security lab I'm working on, I've been tasked with executing multiple commands with a single call to "system()" (written in C, running on Fedora). What is the syntax that will allow me to execute more than command through system()? (The idea being you could execute arbitrary commands through a program running on a remote computer, if the program interacts with the OS through the system() call.)

I.e.:

char command[] = "????? \r\n"; 
system(command);

Answer

Robert Gamble picture Robert Gamble · Oct 29, 2008

That depends on the shell being invoked to execute the commands, but in general most shells use ; to separate commands so something like this should work:

command1; command2; command3

[EDIT]

As @dicroce mentioned, you can use && instead of ; which will stop execution at the first command that returns a non-zero value. This may or may not be desired (and some commands may return non-zero on success) but if you are trying to handle commands that can fail you should probably not string multiple commands together in a system() call as you don't have any way of determining where the failure occured. In this case your best bet would either be to execute one command at a time or create a shell script that performs the appropriate error handling and call that instead.

Related questions

C - The %x format specifier

I have a small question. I know that the %x format specifier can be used to read values from the stack in a format string attack. I found the following code: %08x%08x%08x%08x What does the 08 mean? What …

Read More
How can a Format-String vulnerability be exploited?

I was reading about vulnerabilities in code and came across this Format-String Vulnerability. Wikipedia says: Format string bugs most commonly appear when a programmer wishes to print a string containing user supplied data. The programmer may mistakenly write printf(buffer) …

Read More
Which of sprintf/snprintf is more secure?

I wish to know which of these two options is the more secure one to use: #define MAXLEN 255 char buff[MAXLEN + 1] sprintf(buff, "%.*s", MAXLEN, name) snprintf(buff, MAXLEN, "%s", name) My understanding is that both are same. Please suggest.

Read More