2026-05-12 00:57:45 -04:00
|
|
|
/// Command injection — adversarial collision fixture.
|
|
|
|
|
///
|
2026-06-01 15:58:11 -05:00
|
|
|
/// Prints "NYX_PWN_791_CMDI" unconditionally without going through a shell sink.
|
2026-05-12 00:57:45 -04:00
|
|
|
///
|
|
|
|
|
/// Expected verdict: Inconclusive(OracleCollisionSuspected)
|
2026-06-01 15:58:11 -05:00
|
|
|
/// oracle_fired = true (OutputContains("NYX_PWN_791_CMDI"))
|
2026-05-12 00:57:45 -04:00
|
|
|
/// sink_hit = false (__NYX_SINK_HIT__ never printed)
|
|
|
|
|
/// Cap: CODE_EXEC Entry: `run(payload: &str)`
|
|
|
|
|
pub fn run(payload: &str) {
|
|
|
|
|
// Coincidental oracle match — not a command execution sink.
|
2026-06-01 15:58:11 -05:00
|
|
|
println!("NYX_PWN_791_CMDI");
|
2026-05-12 00:57:45 -04:00
|
|
|
let _ = payload.len();
|
|
|
|
|
}
|