Could someone try this one ?
[root@test ~]# echo -e "\x9\x9 /bin/home/foo/sh" | ssh localhost bash -i 2>&1 |
grep foo
root@localhost's password:
[root@test ~]# foo
[root@test ~]# cat /home/foo/sh
echo foo
De : Vincent Leduc
À : "bug-bash@gnu.org"
Envoyé le : Lundi 29 décembre 2014 1
I still have differents results, depending on the input. Is this a bug ?
[foo@test ~]$ /bin/bin/uname
Display all 1066 possibilities? (y or n)
[foo@test ~]$ /bin/uname
Linux
[foo@test ~]$ /foo/bin/uname
Display all 1066 possibilities? (y or n)
[foo@test ~]$ /una
Looking threw bash 4.3, it seems that readline/complete.c is forking a child
too.
Maybe i'm wrong, but why the static int get_y_or_n could execute something ?
# ssh foo@test "strace -Ff -e execve /bin/bash_4.3 -i"
bash_4.3: cannot set terminal process group (-1): Invalid argument
bash_4.3: no jo
