> For the complete documentation index, see [llms.txt](https://the-winrars.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://the-winrars.gitbook.io/writeups/2020-writeups/zh3r0-ctf/pwn/command1.md).

# Command1

You can add commands, edit commands, run commands. Running commands means system will be run on it. Our goal will be to run /bin/sh, and pop a shell. If we try to add a command with value /bin/sh, the program will not allow us. However, there are no checks upon command edits. So we can create a command, add whatever we want, then edit the command and put /bin/sh inside. Then run the command. You'll be dropped into a shell, cat flag.txt Flag: zh3r0{the\_intended\_sol\_useoverflow\_change\_nextpointer\_toFakechunk\_in\_bssname}