# Bash
## # Related Pages
{% content-ref url="hacking-linux-boxes" %}
[hacking-linux-boxes](https://book.jorianwoltjer.com/linux/hacking-linux-boxes)
{% endcontent-ref %}
> [#attacking-bash-scripts](https://book.jorianwoltjer.com/linux-privilege-escalation/command-exploitation#attacking-bash-scripts "mention")
## Description
Bash is the command line that almost all Linux machines use, or at least are built on top of. It has a lot of special syntaxes to customize how a command is run, and what the arguments are.
### `bash` vs `sh`
`bash` is an improved version of `sh`, with a lot of features like command substitution, redirection and much more syntax.
Sometimes you may find yourself in an `sh` shell, and want to upgrade to `bash`. In an interactive shell, you can simply run `/bin/bash`, and otherwise use `/bin/bash -c 'command'`. In this string, you can put any bash syntax and make sure it is run with bash, instead of sh.
### Chaining Commands
One very powerful feature of bash is its ability to chain multiple commands together.
You can simply execute multiple after each other commands in one line by separating them with a `;` semicolon:
$ echo a; echo b
a
b
This becomes more powerful when introducing conditions. Programs all return an exit code, which is supposed to be 0 on success, and anything else on failure. Using the `&&` syntax you can run the second command only if the first was successful.
$ base64 file.txt && echo "Success!"
SGVsbG8sIHdvcmxkIQo=
Success!
$ base64 wrong.txt && echo "Success!"
base64: wrong.txt: No such file or directory
The opposite of this is the `||` syntax. It only runs if the first command was *un*successful.
$ base64 file.txt || echo "Error!"
SGVsbG8sIHdvcmxkIQo=
$ base64 wrong.txt || echo "Error!"
base64: wrong.txt: No such file or directory
Error!
The most powerful operator in bash is the `|` pipe operator. It allows you to chain commands together, by putting the first command's STDOUT into the second command's STDIN. Many tools support input from STDIN in some way to allow this chaining of commands:
$ seq 1 5 | sed s/3/THREE/
1
2
THREE
4
5
# # Some commands that expect a filename argument, accept '-' to read from STDIN
$ seq 1 10 | ffuf -u http://example.com/FUZZ -w -
### Wildcards
Sometimes you want to perform some action on multiple files with a certain pattern. If you want to run a command on every file in a certain directory, for example, wildcards are a really useful option. Here is an example:
$ ls
first second third
$ file first second third
first: empty
second: ASCII text
third: PNG image data, 800 x 600, 8-bit/color RGBA, non-interlaced
$ file *
first: empty
second: ASCII text
third: PNG image data, 800 x 600, 8-bit/color RGBA, non-interlaced
A wildcard simply **replaces the pattern with all files matching the pattern**, separated by spaces. There are a few different characters that are wildcards, and have different functions:
* `*`: Matches any text of any length (example: `*.txt` matches any file ending with ".txt")
* `?`: Matches any single character (example: `????.txt` matches a 4-character .txt file)
* `[]`: Match any single character in a set (example: `[a-n].txt` matches any single letter file in the first half of the alphabet ending with ".txt")
{% hint style="warning" %}
**Note 1**: By default, these wildcard patterns will **ignore** any file starting with a `.` dot. These are so-called dotfiles that are meant to be more hidden.
**Note 2**: The files that are matched may contain special characters like a `-` dash, which when substituted in a command may become unintended arguments for the command. See the [#wildcards-argument-injection](https://book.jorianwoltjer.com/linux-privilege-escalation/command-exploitation#wildcards-argument-injection "mention") section for more information about the *exploitation* of this fact.
{% endhint %}
### Environment Variables
Environment variables are like temporary variables you can set to influence commands. You can then substitute references to these variables with their value, or let some program read the variable itself.
You can export a variable in the current session using the `export` command:
```shell-session
$ export SOMETHING="text"
```
Then you can refer to that variable later in a future command:
$ echo "$SOMETHING"
text
$ echo "before${SOMETHING}after"
beforetextafter
# # You can also use `env` to see all current variables
$ env | grep SOMETHING
SOMETHING=text
If you want to set a variable for a single command once, and not for the whole session, you can simply prepend the export syntax to the command:
$ SOMETHING="text" env | grep SOMETHING
SOMETHING=text
### Command Substitution
There are a few different ways to execute commands, and put the output of those commands into arguments of another command. This is known as command substitution, as it is replaced with its output.
To simply replace an argument with the literal output of a command, you can surround it with ` `` ` backticks, or the equivalent `$()`:
$ echo `seq 1 10`
1 2 3 4 5 6 7 8 9 10
$ echo $(seq 1 10)
1 2 3 4 5 6 7 8 9 10
Another less common syntax is using `<()`. This replaces the argument with a temporary **path** to the output. It is very useful for commands that expect a filename as an argument, like so:
$ echo <(seq 1 5) <(seq 6 10)
/dev/fd/63 /dev/fd/62
$ cat <(seq 1 5) <(seq 6 10)
1
2
3
4
5
6
7
8
9
10
### Output Redirection
Using some special characters, you can pass the output of a command or file, to other commands or files. The most common is `>`, which writes the output of its left, to a file named on the right:
```shell-session
$ echo "Hello, world!" > file.txt
# # If no command is specified, an empty file is created
$ > new.txt
```
{% hint style="warning" %}
**Warning**: This will replace the file's contents if it already exists. To append data to the output file, you can use `>>`:
$ echo "new line" >> file.txt
$ cat file.txt
Hello, world
new line
{% endhint %}
### Input Redirection (Advanced)
A less common way to read a file as STDIN to a command is by using `<`. It is equivalent to piping `cat [file] |` to the command.
```shell-session
$ ./program < input.txt
```
Another useful trick to specify a string on the command line, to pass as STDIN to a command is using `<<<`:
$ base64 <<< 'Hello, world!'
SGVsbG8sIHdvcmxkIQo=
$ echo 'Hello, world!' | base64 # Equivalent
SGVsbG8sIHdvcmxkIQo=
You can find all details you'll ever need in the manual here, which explains some **interesting tricks**:
{% embed url="" %}
Official manual for bash input/output redirection
{% endembed %}
One is that you can specify a specific file descriptor of where the file should be opened in the program. This may be useful in restricted binary exploitation scenarios, where you need to have a certain file or directory open at a specific file descriptor:
{% code title="\[n]\` characters, which redirect **both** STDOUT and STDERR together into a file:
```shell-session
$ ./program &> output.txt
# # === equivalent to ===
$ ./program >output.txt 2>&1
```
### Escape Characters
{% embed url="" %}
An ASCII table with control characters
{% endembed %}
Use `echo -e` to escape certain untypable characters, like Ctrl+C, or [ansi-escape-codes](https://book.jorianwoltjer.com/other/ansi-escape-codes "mention"):
```shell-session
$ echo -e "\x03" # Ctrl+C
```
## Filter Bypass
If you are trying to bypass some command injection filter, there are a few lesser-known pieces of bash syntax that the author of the filter may not have thought of.
Try some [#command-substitution](#command-substitution "mention"), and here is another really weird trick to not require **spaces**:
```shell-session
$ {cat,/etc/passwd}
$ cat${IFS}/etc/passwd
# # If { or } not allowed:
$ cat$IFS/etc/passwd
# # If you require a normal character after the variable:
$ cat$IFS'file.txt'
$ cat$IFS"file.txt"
```
When *letters* aren't allowed, variables and wildcards are very powerful. This command for example translates to `bash < [every file in the directory]` which might error out some contents of the files if they are not valid bash:
```bash
${0/-/} <*
```
{% hint style="info" %}
For some more advanced usage of these variable substitutions, see [this reference](https://tldp.org/LDP/abs/html/parameter-substitution.html)
{% endhint %}