0

I'm exercising with DVWA high level command injection. I know there is a hole for |, but I'm looking for a way to get an output like the following:

root@vwksOffensive:~# ping -c 4 10.0.0.1 ; ls
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.

--- 10.0.0.1 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3066ms

a    a_post  Documenti  Immagini              Modelli  Musica  pocl         rockyou.txt  Scrivania  WebScarab.properties
Add  b       hash       JavaSnoop.properties  mtu      plain   Pubblici    Scaricati    Video
root@vwksOffensive:~#

starting from 

<<<printf "[ping ip argument] \u003B the_command_I_choose"

My problem is that can do this:

root@vwksOffensive:~# ping -c 4 &lt;&lt;&lt;printf "10.0.0.1"
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.

--- 10.0.0.1 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3055ms

root@vwksOffensive:~#

but I'm not able to do this:

root@vwksOffensive:~# ping -c 4 &lt;&lt;&lt;printf "10.0.0.1 \u003b ls"
PING 10.0.0.1 \u003b ls (10.0.0.1) 56(84) bytes of data.

--- 10.0.0.1 \u003b ls ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3075ms

root@vwksOffensive:~#

and not even this:

root@vwksOffensive:~# ping -c 4 &lt;&lt;&lt;printf "10.0.0.1 ; ls"
PING 10.0.0.1 ; ls (10.0.0.1) 56(84) bytes of data.

--- 10.0.0.1 ; ls ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3075ms

root@vwksOffensive:~#

I searched deeply and the most similar, if it could be said so, is the first answer to this question: How to make a bash function which can read from standard input?

Unfortunately, this did not help me completely, so I decided to post here my question because I'm sure that, in my ignorance, I'm missing something.

The solution must contain the char ; or any other needed special char coded in unicode. The forbidden, substituted with blank, char are the following:

$substitutions = array(
        '&'  => '',
        ';'  => '',
        '| ' => '',
        '-'  => '',
        '$'  => '',
        '('  => '',
        ')'  => '',
        '`'  => '',
        '||' => '',
    );
Community
  • 1
  • 1
Raffa
  • 376
  • 3
  • 5
  • 1
    It's not clear what you are trying to do: `ping -c 4 <<< printf "10.0.0.1"` is equivalent to `ping -c 4 "10.0.0.1" <<< printf`, which is the normal `ping` command that is given `printf` on its standard input, which it ignores. – chepner Feb 06 '17 at 01:39

1 Answers1

0

if the "command you choose" is in a variable like this:

mycmd="ls -l"

then you can wrap your command and other commands in a sub-shell surrounded by this: ( )

The output for the sub-shell can be re-directed into any other command that you want. e.g. tail, grep, > $log, etc.

The ip addresses that you want to send ping can also be in a variable name:

myip=10.0.0.1

(ping $myip  ; $mycmd ) > logfile.txt

It is not clear why you would want to send it in with <<< instead of directly on the command line. If you must use <<<, then still try wrapping the commands in () parenthesis and put a carriage return after the <<< 10.0.0.. and the "ls -l". The parenthesis will tell bash that the command is not done until the closing parenthesis is seen. The carriage return will stop the <<< from consuming the next command.

Mike Wodarczyk
  • 1,247
  • 13
  • 18
  • `<<<` is a `bash`'ism known as a *herestring* which allows redirection of a variable to `stdin` avoiding the `pipe`. (if that is what your "*It is not clear why you would want....*"). – David C. Rankin Feb 06 '17 at 05:59
  • thank you all for the support, I would like to clarify the context to focus on the essential problem. – Raffa Feb 06 '17 at 09:46
  • 1 ) the field is command injection of dvwa (damn web vulnerable application), the command is executed in back-end is: – Raffa Feb 06 '17 at 09:50
  • //Set blacklist $substitutions = array( '&' => '', ';' => '', '| ' => '', '-' => '', '$' => '', '(' => '', ')' => '', '`' => '', '||' => '', ); // Remove any of the charactars in the array (blacklist). $target = str_replace( array_keys( $substitutions ), $substitutions, $target ); $cmd = shell_exec( 'ping -c 4 ' . $target ); so we are talking about inject something in the command "ping -c 4 [IP]" without use the mentioned chars. No way to add a variable in other line – Raffa Feb 06 '17 at 09:56