跳到内容
HackIndex logo

HackIndex

工具

命令注入绕过生成器

Enter a command and a regex filter. We'll generate payloads that bypass it.

\rA-Z]*$\"">

提示：可以带或不带分隔符输入 regex——/pattern/flags 和纯模式均有效。

工作原理

此工具自动查找能通过给定 regex 过滤器的命令注入载荷。它生成数十种混淆的命令变体，并逐一在服务端通过 PHP 对 regex 进行测试——不会执行任何内容。

  1. 1. 输入你的命令: 要注入的原始命令，例如 whoami 或 cat /etc/passwd.
  2. 2. 粘贴 regex 过滤器: 任何格式：PHP /pattern/flags, Python r"pattern" 或 re.compile(...), JavaScript new RegExp(...), Go 反引号，或普通模式。
  3. 3. 选择过滤器类型: 黑名单过滤器阻止匹配的输入（载荷不得匹配）；白名单过滤器只允许匹配的输入（载荷必须匹配）。
  4. 4. 获取绕过方式: 所有通过过滤条件的载荷均会返回，按技术分组，并注明适用的操作系统。

绕过技术分类

生成器涵盖以下适用于 Linux/Bash 和 Windows CMD/PowerShell 的绕过技术系列。

Linux

Encoding (base64 / hex / xxd / octal)

Encodes the entire command using base64 (subshell and pipe-to-sh), raw hex decoded by xxd -r -p, printf \x escapes (lowercase), and ANSI-C $'\x..' quoting. Lowercase-only variants bypass [A-Z] filters.

Linux

Quote splitting

Inserts empty single quotes, double quotes, or backslash escapes inside the keyword, e.g. c''at or c\at, breaking pattern matching without changing shell semantics.

Linux

Space bypass

Replaces literal spaces with $IFS, ${IFS}, a tab character ($'\t'), brace expansion ({cmd,arg}), or input redirection (cat</etc/passwd).

Linux

Slash bypass

Replaces forward slashes using ${HOME:0:1}, ANSI-C $'\x2f', $'\57', or $(printf '\57').

Linux

Variable concat

Splits the command across two shell variables (a=wh; b=oami; $a$b) to avoid matching the full keyword in the regex.

Linux

Alternative commands

Substitutes blocked commands: cat → less, tac, nl, head, xxd; whoami → id; ls → echo *.

Linux

Wildcards / globbing (hint)

Generates c?t and c* variants. These bypass the regex but require the correct binary on the filesystem. Verify manually.

Windows

CMD caret obfuscation

Inserts the ^ escape character between chars (w^h^o^a^m^i). CMD ignores ^ and executes the command normally.

Windows

CMD quote splitting

Inserts empty double quotes (wh""oami). Functionally identical to the unquoted form in CMD.

Windows

CMD variable tricks

Splits across environment variables (set a=wh& set b=oami& call %a%%b%). Also supports delayed expansion via cmd /V:ON and !var!.

Windows

PowerShell backtick

The backtick (`) is a PowerShell escape character silently ignored in identifiers. wh`oami executes as whoami.

Windows

PowerShell encoding

Encodes as UTF-16LE base64 for powershell -enc, or rebuilds from a char array ([char[]](119,104,...) -join '') or string concat ('wh'+'oami').

Windows

PowerShell invoke variants

Uses iex, the & operator, ScriptBlock::Create, or mixed-case IeX without spelling Invoke-Expression.

黑名单与白名单过滤器

黑名单 — 载荷不得匹配

当 regex 匹配时，应用程序会阻止输入。regex 描述危险模式——例如 [;&|`$] 或 cat|ls|whoami. 载荷不得触发 regex 才能通过过滤。

常见于：匹配时执行 die/block 的 PHP preg_match()、Python re.search() 守卫。

白名单 — 载荷必须匹配

只有当 regex 匹配时，应用程序才处理输入。regex 描述允许的字符——例如 ^[^;\/&A-Z]*$. 载荷必须满足 regex，同时仍能执行命令。

常见于：输入验证器、CTF 题目源码、WAF 白名单。

提示：如果 regex 使用以下锚点 ^ 和 $，这几乎始终是白名单。如果你的模式选择看起来有误，工具会发出警告。

支持的 regex 输入格式

按源代码中的原样粘贴 regex——工具会自动检测格式，提取模式和标志，并编译为 PHP 兼容的表达式。

语言 / 格式 示例
PHP / JS / Ruby / Perl /[;&|`$\s]/i
Plain pattern ^[0-9a-z]+$
Python raw string r"^[^;/\&.<>\rA-Z]*$"
Python re.compile re.compile(r"[;&|]", re.IGNORECASE)
JavaScript new RegExp new RegExp("[;&|]", "gi")
Go raw string `^[a-z0-9]+$`
Perl m// m/[;&|]/gi
Quoted string "^[a-z0-9]+$"

常见问题

Does this actually execute commands?

No. Everything runs server-side in PHP. Payloads are generated as strings and tested against your regex with preg_match(). No command is ever executed on the server.

What does "payload must match / must NOT match" mean?

A blacklist blocks input when the regex matches: payload must NOT match. A whitelist only allows input when the regex matches: payload must match. The tool auto-detects which is more likely and warns you if your selection looks wrong.

Why are some payloads marked with a warning?

Wildcard and glob-based payloads (e.g. /bin/c?t) depend on the filesystem layout of the target. They bypass the regex filter, but will only work if the expected binary is present at that path.

Why does my ANSI-C quoting payload not run directly?

An ANSI-C string like $'\x77\x68\x6f\x61\x6d\x69' evaluates to the literal string whoami in bash but does not execute it on its own. Prefix it with eval or bash -c, which are lowercase letters and unlikely to be filtered.

Can I use this for CTF challenges?

Yes. This tool is designed for CTF and authorised penetration testing scenarios where you need to bypass an input filter to achieve command execution. Only use it on systems you own or have explicit permission to test.