I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server. When submitting the form, the following command gets executed:
/bin/ping -c 3 INPUT_TEXT
This feels horribly dangerous [read: interesting] so I started playing around with it to see if I could inject some code.
There are however some (PHP controlled) restrictions. The server won't accept any input with characters other than the things you'd expect for a ping:
No whitespaces, no ';', no special characters. Manipulating the post request itself doesn't resolve this.
Is there any way to sneak something interesting into a shell command using only these available characters?