Re: [dev] [ii] exposed password on process monitoring

[Andrew Hills]

On Fri, Jun 15, 2012 at 7:14 PM, Calvin Morrison <mutanttur...@gmail.com> wrote:
> On Jun 15, 2012 6:13 PM, "Kurt H Maier" <khm-suckl...@intma.in> wrote:
>> On Fri, Jun 15, 2012 at 05:28:14PM -0400, Calvin Morrison wrote:
>> > Why not just pass the argument from a file?
>> >
>> > Exec --flag `cat password-file`
>> hahahah
> What is so funny?

Try this for me: take the attached file, argv.c, and drop it
somewhere; find it, run "make argv", and then do something like:
$ echo secretpassword > passwordfile
$ ./argv `cat passwordfile`
Look at the output. If you haven't caught on yet, run ps or top and
look at the process. Make sense now?

--Andrew Hills

#include <stdio.h>

int main(int argc, char** argv)
{
    int i;
    for(i = 0; i < argc; i++)
        printf("argv[%d]=\"%s\"\n", i, argv[i]);
    for(;;);
    return 0;
}