After completing the OS Command Injection level on High, I was delving a little deeper so I could write it up. It seems that while the solution works on the web app the same command errors on the linux terminal.

DVWA command for the High level|  |cat /etc/passwd

This works. Doesn't output the ping result but prints to screen the contents of /etc/passwd

If I use the exact same command on my linux terminal it errors. Code used to mimic the web application

ping -c 3|  |cat /etc/passwd

I receive the error

bash: syntax error near unexpected token `|'

If I remove the spaces the command works as expected. I can't explain why the shell_exec PHP command passes the command to the OS, the OS runs it and displays the result, yet the direct approach errors. Technically the DVWA command shouldn't work?

  • Unrelated to your question, but /etc/passwd is generally considered public information on a Linux system, as one of its purposes is to map from numeric user IDs to plain-text usernames (useful for example in file listings).
    – user
    Jan 26 '17 at 15:41

It's caused by the deliberately faulty blacklist. Pipe followed by space gets replaced with an empty string. The second pipe is immediately followed by a c and thus does not match the blacklist and hence slips through. The first pipe and space are redundant. Ip|cat should also work, as does ip%0acat and ip%26%26cat.


DVWA Command Injection Hign file in Blacklist

// Set blacklist $substitutions = array( '&' => '', ';' => '', '| ' => '', '-' => '', '$' => '', '(' => '', ')' => '', '`' => '', '||' => '', );

  • This is "&&" not in blacklist.

  • This is using "&&"; ping -c4 && echo "Ok!"

  • That command doesn't work on version 1.10. Only the double pipes with two spaces works it seems.
    – Paulst30
    Jan 31 '17 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.