Hacker News Reader

Comment by tomsmeding | Hacker News Reader

The patch given on that page includes the line:

    !id>~/pwn.lol;beep # 13-21 12:53:21.000000000 +0100

Not bothering to test it, but I don't think that contributes to patching beep. Why do people always need to be annoying?

View on HN

Congratulations. You found the actual exploit.

http://git.savannah.gnu.org/cgit/patch.git/tree/src/pch.c#n2...

patch calls /bin/ed. /bin/ed has a ! command that feeds stuff to /bin/sh. Feeding unreviewed patches to the patch command is actually arbitrary command execution.

This is particularly awesome if patch is being used by other programs (i.e. a CI pipeline or other contexts).

Reply on news.ycombinator.com