jwilk / url.sh

this URL is also malicious(?!) shell script
MIT License
143 stars 5 forks source link

zsh: command not found: cowsay \t\n #2

Open jwilk opened 2 years ago

jwilk commented 2 years ago

The current URL doesn't do the right thing in Zsh:

% true http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned
zsh: no such file or directory: $(gt=$(perl$IFS-E$IFSs//62/
zsh: no such file or directory: s/62/chr/e
zsh: no such file or directory: say);eval$IFScowsay$IFSpwned$IFS$gt/dev/tty)
zsh: command not found: cowsay \t\n

This is because Zsh, unlike POSIX-complaint shells, doesn't perform word splitting of unquoted variables: https://zsh.sourceforge.io/FAQ/zshfaq03.html

We can fix it by inserting c=(setopt);c+=(shwordsplit);$c; (which enables said word splitting) in two strategic places: http://example.com/;'$(c=(setopt);c+=(shwordsplit);$c;gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';c=(setopt);c+=(shwordsplit);$c;cowsay$IFS''pwned

The fixed URL happens to work also in bash and mksh, but might not work in other shells; it doesn't work in dash, for example.

Alternatively, one could use a shorter Zsh-only URL: http://example.com/;'$(c=(perl;-E;'s//62/;s/62/chr/e;say');gt=$($c);c=(eval;cowsay;pwned;$gt;/dev/tty);$c)';c=(cowsay;pwned);$c

jwilk commented 2 years ago

Any ideas how to make this work in Zsh while keeping it compatible with POSIX shell?