4

I have some PHP code that run bash commands, and it has a bug that may make it vulnerable to remote code execution.

The executed command would be $(id), but if I execute any other command like ls -la the space is automatically replaced with -. I checked the source as well and I found that in addition to spaces, the following chars are filtered: '`/\<>?&|.

How can I bypass the filter and execute a command like wget link?

Live demo.

Improve this question

1 Answer 1

Reset to default
4

If spaces are filtered but not tabs, just use a tab. If both are filtered but $ isn't, you can use ${IFS}.

If you can do command substitutions and spaces, it may help to use various printf format specifiers, tr with ranges and eval to reach forbidden characters.

Improve this answer
3
  • printf runs as string . cant bypass with it, do you have any live demo?
    – user2444995
    Commented Apr 9, 2018 at 9:51
  • @user2444995: I think the StackExchange formatting ate some of your comment. Please use a pair of backticks ` to protect your special characters. (Anders fixed your question, but your comment seems to miss characters as well)
    – MSalters
    Commented Apr 9, 2018 at 12:16
  • @user2444995 For example, with the characters you have, printf${IFS}-v${IFS}bs${IFS}%q${IFS}"$IFS";bs=${bs:3:1} sets the variable bs to a backslash.
    – Gilles 'SO- stop being evil'
    Commented Apr 9, 2018 at 16:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .