Puzzle. Moderately easy difficulty.

puzzle

# Exploit this vulnerable program to run an arbitrary command without renaming or adding any files.

k# ksh -c 'touch printf "you fail\n"; printf "%s: " "give me a value"; read -r b; a=(~(N)*); "${a[@]}" "$b" "$@"' _ args...; code...

solution

# My solution. There may be others.

k# ksh -c 'rm *; touch printf "you fail\n"; printf "%s\n" "give me a value"; read -r b; a=(~(N)*); "${a[@]}" "$b" "$@"' \
_ I win. |& { sleep .2; rm -- ~(N)*; print -p echo; cat <&p; }