shellshock research: wrap /bin/sh and log all calls to it to see what is potentially vulnerable

gistfile1.c

/*
 * rename /bin/sh to /bin/sh.org for the script to work
 *
 * compile with 'gcc -Wall sh-wrap.c -o sh-wrap'
 *
 * can do same for bash
 */

#include <unistd.h>
#include <stdio.h>

int main (int argc, const char * argv[]) {
  FILE *fp;

  pid_t myPid = getpid();
  pid_t parentPid = getppid();

  fp = fopen("/tmp/sh-wrap-out.txt","a+");
  fprintf(fp, "pid: %d, ppid: %d\n", myPid, parentPid);
  fclose(fp);

  return execv("/bin/sh.org", argv);
}