webeasy

RCE IFS

spbctf

Task: Web form with SHA-384 hashing via shell command, spaces filtered from input. Solution: Command injection using ${IFS} to bypass space filter and # to neutralize the pipe to sha384sum.

$ ls tags/ techniques/
command_injectionrcephpshell_injectionifs_bypassspace_filter_bypasssha384sumsystem_exec
ifs_space_bypassshell_comment_neutralizationcommand_chaining_semicolon
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]