I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server. When submitting the form, the following command gets executed:

/bin/ping -c 3 INPUT_TEXT

This feels horribly dangerous [read: interesting] so I started playing around with it to see if I could inject some code.

There are however some (PHP controlled) restrictions. The server won't accept any input with characters other than the things you'd expect for a ping:

  • a-z
  • 0-9
  • A-Z
  • -
  • :
  • .

No whitespaces, no ';', no special characters. Manipulating the post request itself doesn't resolve this.

Is there any way to sneak something interesting into a shell command using only these available characters?

  • Is /bin/ping executing in a shell or just being executed directly? The former (true shell injection) is far easier to exploit than the latter, and I'm not even sure an actual shell injection is exploitable with such a constrained input set. – CBHacking Mar 13 '19 at 21:38
  • Did you try encoding the characters to try to bypass the PHP checks? Do you have access to the PHP code doing the checks? – m0skit0 Mar 14 '19 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.