* Arbitrary code execution in commands of Zsh shell.
@ 2023-06-16 12:28 LitHack
2023-06-16 12:52 ` Roman Perepelitsa
0 siblings, 1 reply; 2+ messages in thread
From: LitHack @ 2023-06-16 12:28 UTC (permalink / raw)
To: zsh-workers
[-- Attachment #1.1: Type: text/plain, Size: 166 bytes --]
Found a bug by which we can run our command in any other commands.
Syntax:
{any command}>({our command})
Example:
unzip v.zip>(ls)......The command ls be executed.
[-- Attachment #1.2: Type: text/html, Size: 357 bytes --]
[-- Attachment #2: IMG-20230616-WA0001.jpg --]
[-- Type: image/jpeg, Size: 80504 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Arbitrary code execution in commands of Zsh shell.
2023-06-16 12:28 Arbitrary code execution in commands of Zsh shell LitHack
@ 2023-06-16 12:52 ` Roman Perepelitsa
0 siblings, 0 replies; 2+ messages in thread
From: Roman Perepelitsa @ 2023-06-16 12:52 UTC (permalink / raw)
To: LitHack; +Cc: zsh-workers
[-- Attachment #1: Type: text/plain, Size: 396 bytes --]
On Fri, 16 Jun 2023 at 14:29, LitHack <lithack0@gmail.com> wrote:
> Found a bug by which we can run our command in any other commands.
>
> Syntax:
> {any command}>({our command})
>
> Example:
> unzip v.zip>(ls)......The command ls be executed.
>
This feature (not a bug) is called Process Substitution. See
https://zsh.sourceforge.io/Doc/Release/Expansion.html#Process-Substitution.
Roman.
>
[-- Attachment #2: Type: text/html, Size: 1267 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-06-16 12:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-06-16 12:28 Arbitrary code execution in commands of Zsh shell LitHack
2023-06-16 12:52 ` Roman Perepelitsa
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).