-1

I have a blind command injection vulnerability on an embedded device. I have tested ping, reboot and sleep and they work. But whenever there is a forward slash in the input ( / ), the program crashes for some reason. How can I overcome this? Is there anyway i can not use a forward slash for file paths?

closed as off-topic by Polynomial, Steffen Ullrich, Xander, Teun Vink, Jeroen Mar 20 at 6:44

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Polynomial, Steffen Ullrich, Xander, Teun Vink, Jeroen
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Why do you want to use a forward slash? What are you trying to achieve with this command injection? – Sjoerd Mar 14 at 11:25
  • For file paths. i should also note that telnet is filtered but when i tried to execute "iptables -I APPIN -p tcp --dport 23 -i <interface> -j ACCEPT", telnet does not open. Any help? – Adi Agha Mar 14 at 11:32
  • Most likely you are not executing commands as root? Do you know the user you are executing the commands with? – Jeroen Mar 14 at 11:53
  • I can't say I'm 100% sure but I assume it is root. But I highly doubt this is the cause of the crash. Is it possible that this is some kind of security measure? – Adi Agha Mar 14 at 12:06
2

It's possible that a security check is removing the forward slash or you're hitting a restricted shell that simply doesn't allow forward slashes at all.

If it's a security check, try with a double slash (//). If the check isn't recursive, it might remove the first slash and leave the second one.

If it's a restricted shell, then you have to get creative. For example, try using an encoded forward slash as demonstrated at that link.

  • double slash didn't work. Is there any way I could unfilter the telnet protocol? – Adi Agha Mar 14 at 13:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.