Defeating Whitespace Limitations for RCE



Introduction:

this is not a full-length tutorial on RCE, but rather just going to be a short guide that is going to be specifically detailing a few methods for defeating whitspace limitations when exploiting RCE Vulnerabilities. In the future I think I will write a full length tutorial on RCE exploitation with a bunch of private bypass methods.

If whitespace is stripped then it would prevevnt an attacker who wasn't dedicated from being able to execute any useful commands (they could still execute a simple command such as 'ls' or 'id' but they would not be able to use something like curl/wget to spawn a shell or view the contents of a specific file, etc). This will be detailing a bunch of techniques that you can employ when whitespace is being stripped in order to emulate whitespace (I'd suggest always trying %20 and + to begin with though)

For example, lets assume an attacker had a simple post-based RCE where it was passing user inputs through exec(); without any sanatization other than stripping whitespace, and they wanted to execute cat /etc/passwd in order to view the contents of the passwd file, the following command:

would be changed to:
which would prevent it from executing



Methods:

Start with the basics, some servers will render CRLF as whitespace or a null-byte can simply be prevent the code from being applied which strips whitespace:

or:
where OD/OA is actually 0D/0A (with zero's)

One of the most common methods to get around whitespace limitations is to use bash's internal field separator (IFS) to emulate whitespace, like so:

Expansion can also be used for internal field separator:

if Internal Field Seperator is blocked, it's possible to create your own whitespace as a result of setting a var:

Although a more elegant solution (if permitted) would be to use bash expansion tricks):

of course terms like /etc/passwd may also trigger a waf response so its best to mix this up with other bypass techniques while testing, shellopts is a good one:

with $IFS

with expansion

setting var to emulate whitespace

All of the above are equivalent to:

Hope you enjoyed, and I hope someone has learned something from this and will put it to good use :D