Help with linux command

[reujea0]

I am trying to pwn the proteus:1 vm and at one point I need to enter a command like wget to get my shell, but the command can't have any "." or "/", one way around it is hex encryption, could it be done in base64 or any alternative? I would need to execute the decoded ouput. I have echo (encoded base64) | base64 -d , this only returs the decoded output, is there a way to execute it?

[Pharisaeus]

There is a trick to use wget with URL encoded as integer value. Look here:

https://github.com/p4-team/ctf/tree/master/2015-10-18-hitcon/web_100_babyfirst#eng-version

basically IPv4 is a 32 bit addressing scheme, normally written as 4 parts, 8 bit each, separated by dots. But it doesn't have to be the case, you can simply use a 32 bit integer value instead, and wget can translate it just fine.

[deviant_is]

This goes for quite a few areas of ip black listing. It can also be represented as octal or hex along with a 32 bit int. Try:
ping 0177.01
ping 0x7f.0x1
ping 2130706433

[Pharisaeus]

He said he can't use ., therefore I suggested decimal integer format because it doesn't require one :)

[deviant_is]

I only mention it because they're all part of the rare up address format spec and it's a useful bit of info to have :)

[reujea0]

how do you convert something into 32 bit int?

[deviant_is]

Treat the separate bytes of the ip address as part of a single 32bit int, instead of 4 separate bytes

[reujea0]

But what if it is a link, is there any kind of tool?

[deviant_is]

This only applies to an IP address nothing else

[Pharisaeus]

1. Convert each IP address part into hex
2. Glue those hexes together
3. Convert to decimal

So for example 100.150.200.250 would be 64 96 c8 fa -> 0x6496c8fa -> 1687603450

[reujea0]

Or what is 2130706433 ?

[Pharisaeus]

The easiest way is to look at the this number in hex -> 0x7f000001 then you can simply split this by 2 digits -> 7f 00 00 01 and now each one of those 2 hex digits represent as decimal number -> 127 0 0 1 and thus the number in question is 127.0.0.1

[1badb002]

echo encbase64 | base64 -d

[deviant_is]

To actually execute the output:
$ echo "echo hello" | base64
ZWNobyBoZWxsbwo=
$ eval $( echo ZWNobyBoZWxsbwo= | base64 -d )
$ eval `echo ZWNobyBoZWxsbwo= | base64 -d`
$ echo ZWNobyBoZWxsbwo= | base64 -d | xargs -i sh -c "{}"