Running two commands in same variable in Bash CGI

Question

In my Bash CGI script, I take a command passed as GET parameter and execute it. This could be:

CMD='ls -al'
$CMD

Which works fine and produces expected output. But if I try to pass two commands with

CMD='ls -al; echo hello'
$CMD

or

CMD='ls -al && echo hello'
$CMD

neither command gets executed.

How can I run multiple commands from the same line/variable in my bash CGI?

Answer 1

You can execute variables as bash code using bash :

# UNSAFE, DO NOT USE
cmd='ls -al; echo hello'
bash -c "$cmd"

Alternatively, depending on the context you want to run it in, you can use eval "$cmd" to run it as if it was a line in your own script, rather than a separate piece of shell code to execute:

# UNSAFE, DO NOT USE
cmd='ls -al; echo hello'
eval "$cmd"

Both of these methods have serious implications for security and correctness, so I felt I had to add warnings to prevent them from being copied out of context.

For your remote shell or root kit specifically meant to run insecure user input, you can ignore the warnings.