4

I have some PHP code that run bash commands, and it has a bug that may make it vulnerable to remote code execution.

The executed command would be $(id), but if I execute any other command like ls -la the space is automatically replaced with -. I checked the source as well and I found that in addition to spaces, the following chars are filtered: '`/\<>?&|.

How can I bypass the filter and execute a command like wget link?

Live demo.

Improve this question

1 Answer 1

Reset to default
4

If spaces are filtered but not tabs, just use a tab. If both are filtered but $ isn't, you can use ${IFS}.

If you can do command substitutions and spaces, it may help to use various printf format specifiers, tr with ranges and eval to reach forbidden characters.

Improve this answer
3
  • printf runs as string . cant bypass with it, do you have any live demo?
    – user2444995
    Apr 9, 2018 at 9:51
  • @user2444995: I think the StackExchange formatting ate some of your comment. Please use a pair of backticks ` to protect your special characters. (Anders fixed your question, but your comment seems to miss characters as well)
    – MSalters
    Apr 9, 2018 at 12:16
  • @user2444995 For example, with the characters you have, printf${IFS}-v${IFS}bs${IFS}%q${IFS}"$IFS";bs=${bs:3:1} sets the variable bs to a backslash.
    – Gilles 'SO- stop being evil'
    Apr 9, 2018 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.