Deep Sea Exploitation

//...
void probe_section(char* section) {
    char command[512];
    char path[256];

    // Create the path
    snprintf(path, sizeof(path), "./research/%s", section);

    printf("[PROBING]: %s\n", section);

    // Basic input filtering - block common command injection attempts and tell them what we blocked
    char *blocked_commands[] = {
        "cat", "head", "tail", "more", "less", "grep", "awk", "cut", "sort", "uniq", "tr", "wc",
        "find", "locate", "which", "whereis", "file", "strings", "hexdump", "xxd", "od", "base64",
        "python", "perl", "php", "ruby", "node", "sh", "bash", "zsh", "dash", "csh", "tcsh", "ksh", "fish",
        "nc", "netcat", "wget", "curl", "ftp", "ssh", "scp", "rsync", "cp", "mv", "rm", "mkdir", "rmdir",
        "touch", "chmod", "chown", "chgrp", "ln", "dd", "tar", "zip", "unzip", "gzip", "gunzip",
        "bzip2", "bunzip2", "xz", "unxz", "7z", "rar", "unrar", "ps", "top", "htop", "kill", "killall",
        "pkill", "nohup", "jobs", "bg", "fg", "disown", "screen", "tmux", "sudo", "su", "passwd",
        "useradd", "userdel", "usermod", "groupadd", "groupdel", "id", "whoami", "who", "w", "last",
        "lastlog", "history", "env", "export", "set", "unset", "alias", "unalias", "type", "command",
        "builtin", "enable", "disable", "exec", "eval", "source", "read", "echo", "printf", "test",
        "expr", "bc", "dc", "calc", "vim", "vi", "nano", "emacs", "pico", "joe", "mc", "man", "info",
        "help", "apropos", "whatis"
    };

    int num_blocked = sizeof(blocked_commands) / sizeof(blocked_commands[0]);

    for (int i = 0; i < num_blocked; i++) {
        if (strstr(section, blocked_commands[i]) != NULL) {
            printf("SECURITY ALERT: Command '%s' is blocked by security filters\n", blocked_commands[i]);
            printf("Attempted command injection detected and prevented\n");
            return;
        }
    }

    sprintf(command, "ls -l %s 2>/dev/null", path);
    system(command);
}
//...