dtolpin / ff-all-plans Goto Github PK

Taking the example of a reverse-shell, with only 2 files descriptors available (fd0 and fd1, respectively for the input and output streams), and generating all plans without transpositions, all plans start with:

close fd1
socket fd1

when there exists legal plans plans starting with:

close fd0
socket fd0

Also tested with transpositions (until 20.000 plans), same problem.

When generating all plans, actions not going toward the goal are inserted. With the example of the reverse-shell (with file descriptors fd0, fd1, fd2, fd3 and fd4 available), it generates:

close fd1
socket fd3
connect fd3
dup fd3 fd1
close fd0
dup fd3 fd0
close fd2
socket fd2
execve sh

When we would expect:

close fd1
socket fd3
dup fd3 fd4
connect fd4
dup fd3 fd1
close fd0
dup fd3 fd0
execve sh

As a shorter plan going toward the goal.