Re: Command injection with no spaces

[Joe Sylve <joe.sylve () gmail com>]

Try something like this for command execution:

CMD=$'cat\x20/etc/passwd';$CMD

On Thu, Jun 14, 2012 at 7:25 AM, Matt Summers <matt () fireantsecurity co uk>wrote:

> I haven't tried tabs.
>
> One thing I forgot to mention is that the limitation on space is because
> the web server converts the space to %20 and this cant be interpreted by
> the shell.
>
>
>
> On Thu 14/06/12 14:14 , "Robin Wood" robin () digininja org sent:
>
> On 14 June 2012 10:18, Matt Summers <matt () fireantsecurity co uk> wrote:
> > Folks,
> >
> > We came across an interesting bug in a web system where we could execute
> any
> > system command (on AIX) but we could not enter any spaces in the command
> and
> > we would only get the last line of STDOUT.
> >
> > Has anyone else come across anything like this?
> >
> > The most we were able to do was cat the last line from system files and
> > determine if a directory existed.
> >
> > Cheers,
>
> Have you tried using tabs instead of spaces?
>
> Robin
>
> > Matt
> >
> > --- Part time worker full time salary ---
> > _______________________________________________
> > Pauldotcom mailing list
> > Pauldotcom () mail pauldotcom com
> > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom";>
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> > Main Web Site: http://pauldotcom.com";>http://pauldotcom.com
>
>
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom () mail pauldotcom com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
_______________________________________________
Pauldotcom mailing list
Pauldotcom () mail pauldotcom com
http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
Main Web Site: http://pauldotcom.com