0

Why does command injection not work in 

$ bash -c "ls \$1" bash '.; echo hello'
ls: cannot access '.;': No such file or directory
ls: cannot access 'echo': No such file or directory
ls: cannot access 'hello': No such file or directory

while

$ bash -c "eval ls \$1" bash '.; echo hello'

works?

In the first command, does the first bash perform parameter expansion on $1, word splitting on the result of expanding $1, and then execute the commands?

Thanks.

Originated from Ways to provide arguments to a command executed by `bash -c`

related to Why is this code injection not working?

Tim
  • 98,580
  • 191
  • 570
  • 977

1 Answers1

2

This is the same process as in "run any command which will pass untrusted data to commands which interpret arguments as commands".

Your first command,

bash -c "ls \$1" bash '.; echo hello'

is processed as follows:

  • bash runs with the arguments -c, ls $1, bash, .; echo hello. bash reads its arguments, notes the -c option with the command ls $1, and the extra arguments bash and .; echo hello;

  • when bash expands ls $1, it expands to ls with the arguments .;, echo, hello and runs that.

The semi-colon would have had to be processed before variable expansion to cause bash to run two different commands.

Your second command,

bash -c "eval ls \$1" bash '.; echo hello'

is processed as follows:

  • bash runs with the arguments -c, eval ls $1, bash, .; echo hello. bash reads its arguments, notes the -c option with the command eval ls $1 etc.

  • after expansion it runs eval with the arguments ls, .;, echo, hello;

  • eval then causes the arguments to be re-parsed, resulting in the execution of ls . followed by echo hello.

Tim
  • 98,580
  • 191
  • 570
  • 977
Stephen Kitt
  • 411,918
  • 54
  • 1,065
  • 1,164
  • Thanks. Can you construct a command of form `bash -c "somecommand \$1" bash $somevariable`, where command injection works? – Tim Jun 08 '18 at 13:41
  • Well the reason is that shell macros are expanded in the interpreter but not in the parser already. As a result, everything that would need syntax parsing does not happen. – schily Jun 08 '18 at 16:03