Evading Command Injection Filters

Hello! Welcome back.

In our last lesson, you learned how to identify and exploit OS command injection vulnerabilities, a critical step in shifting our focus from the client to the server. You mastered both in-band exploitation and the more subtle art of blind injection using time delays, output redirection, and out-of-band (OAST) techniques.

However, most real-world applications won't just sit there and let you run whoami. Developers often implement filters—blacklists of "dangerous" characters and keywords—to block these attacks. Today's lesson is about defeating those defenses. This is where skill and creativity truly separate a novice from a professional.

Your learning outcome is to bypass command injection filters using techniques like command separators, wildcards, and encoding. We will explore how to deconstruct and circumvent these filters systematically, turning a blocked attempt into a successful exploit.

1. The Bypass Mindset: A Systematic Approach

Before we dive into specific tricks, it's crucial to adopt a methodical mindset. Instead of randomly trying payloads from a list, a professional tester first seeks to understand the filter's rules.

A great way to conceptualize this is by watching how experts approach Web Application Firewalls (WAFs), which are essentially sophisticated, external filter systems. The principles are the same for simpler, application-level filters.

With this methodology in mind, let's explore the common types of filters you'll encounter and the specific techniques to bypass them.

2. Common Filter Bypass Techniques

We'll use a combination of video demonstrations and a comprehensive payload list to build your arsenal. Many of these techniques leverage the rich, and often surprising, features of the Linux shell.

2.1. Bypassing Command and Separator Blacklists

Developers often start by blacklisting common commands (cat, ls, nc) and command separators (;, |, &).

To demonstrate some basic bypasses for these, let's watch a short, practical video.

The quoting technique is simple yet effective against basic string-matching filters. The shell simply processes the quotes and reconstructs the original command.

2.2. Bypassing Space Filters

A very common and surprisingly effective defense is to filter or remove space characters. Without spaces, you can't separate a command from its arguments, right? Not exactly. The shell provides several powerful alternatives.

• Internal Field Separator ($IFS): This is a special shell variable that, by default, contains whitespace characters (space, tab, newline). You can use it in place of a space. For example, cat /etc/passwd becomes cat${IFS}/etc/passwd.
• Brace Expansion: Some shells allow you to use braces to separate items. For example, {cat,/etc/passwd} can be expanded by the shell.
• Input Redirection: Instead of providing a filename as an argument, you can redirect the file's content into the command. cat /etc/passwd becomes cat</etc/passwd.
• URL-encoded Tab (%09): Similar to how %0a is a newline, %09 is a tab character, which the shell also often treats as a space.

Let's see the tab character bypass in action.

2.3. Constructing Commands with Wildcards

What if the filter is more advanced and blocks keywords like cat or passwd even with quotes? This is where wildcards come in. The shell's pattern-matching capabilities can be used to construct commands and file paths without explicitly typing them.

• ? matches any single character.
• * matches any sequence of characters (including an empty sequence).

So, if cat is blocked, you can try /bin/c?t. If /etc/passwd is blocked, you might use /etc/pass??.

A more complex example could be executing ls:

• /?in/?s could expand to /bin/ls on many systems.

This technique requires some knowledge of the target system's file structure but can be incredibly powerful.

3. Advanced Bypasses: Encoding and Shell Programming

For the most stubborn filters, you need to go a step further. This involves encoding your entire payload or using advanced shell features to generate forbidden characters and commands on the fly. Given your CS background, you can think of this as a form of metaprogramming within the shell.

Encoding

If a filter is looking for ASCII patterns like cat, you can often bypass it by providing the command in a different format that the shell can interpret.

• Hex Encoding: You can use tools like echo or xxd to execute commands from their hex representation.
  • echo -e "\x63\x61\x74\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64" will print the string cat /etc/passwd.
  • You can combine this with command substitution to execute it: `echo -e "\x63\x61\x74..."`
• Base64 Encoding: A very common technique.
  • echo "Y2F0IC9ldGMvcGFzc3dkCg==" | base64 -d | bash
  • This takes the Base64-encoded string for cat /etc/passwd, decodes it, and pipes the result directly into a new bash process for execution.

Generating Forbidden Characters

Sometimes even characters like / are blocked. You can generate them using shell features.

• Variable Expansion: Many environment variables contain characters you can use. ${HOME} is often /home/user. So, ${HOME:0:1} gives you the first character: /.
  • Payload: cat ${HOME:0:1}etc${HOME:0:1}passwd

These techniques require more effort but can circumvent very restrictive filters.

4. Your Ultimate Reference: PayloadsAllTheThings

The number of bypass techniques is vast and depends on the specific shell (bash, sh, zsh) and OS. Memorizing them all is impossible. Professionals rely on comprehensive cheat sheets. The most respected one is PayloadsAllTheThings.

Conclusion

You've now moved beyond basic command injection and into the creative, problem-solving phase of exploitation. Bypassing filters is a continuous cat-and-mouse game that requires a deep understanding of how shells interpret commands.

Key Takeaways:

• Adopt a Methodology: Don't guess. Systematically test payload components to find what a filter blocks, then find a way around that specific part.
• Common Bypasses:
  • Spaces: Use $IFS, < redirection, or %09 (tab).
  • Keywords: Obfuscate with quotes (c'a't) or use wildcards (/bin/c?t).
  • Separators: Use URL-encoded newlines (%0a) if | and ; are blocked.
• Advanced Bypasses: For tough filters, use encoding (Hex, Base64) or shell features like variable expansion to generate commands and forbidden characters.
• Use Cheat Sheets: No one remembers everything. Resources like PayloadsAllTheThings are essential tools of the trade.

Next Lesson Preview:
So far, we have achieved Remote Code Execution (RCE) through a direct command injection vulnerability. However, RCE is often the result of chaining multiple, less severe vulnerabilities together. In the next lesson, we will explore how a Local File Inclusion (LFI) vulnerability can be escalated to full RCE by poisoning log files or other on-server files with malicious data, a classic and powerful attack chain.