I have a blind command injection vulnerability on an embedded device. I have tested ping, reboot and sleep and they work. But whenever there is a forward slash in the input ( / ), the program crashes for some reason. How can I overcome this? Is there anyway i can not use a forward slash for file paths?
closed as off-topic by Polynomial, Steffen Ullrich, Xander, Teun Vink, Jeroen Mar 20 at 6:44
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Polynomial, Steffen Ullrich, Xander, Teun Vink, Jeroen
It's possible that a security check is removing the forward slash or you're hitting a restricted shell that simply doesn't allow forward slashes at all.
If it's a security check, try with a double slash (//). If the check isn't recursive, it might remove the first slash and leave the second one.
If it's a restricted shell, then you have to get creative. For example, try using an encoded forward slash as demonstrated at that link.