Java Execution Gotchas

Java Unicode escape filter bypass

Java Unicode escapes are translated before Java source is tokenized. This matters when filtered input later becomes Java source, such as source passed to H2 CREATE ALIAS.

Given a literal-character filter:

if (value.contains("$")) {
    String result = "blocked";
    return result;
}

The following input does not contain a literal $ when the filter runs:

\u0024{IFS}

If the same characters later appear in compiled Java source, Java translates \u0024 into $ before compilation:

String command = "id\u0024{IFS}";

The resulting runtime string is:

id${IFS}

The complete data flow is:

request contains \u0024
-> literal $ filter does not match
-> input reaches Java source
-> Java Unicode translation converts \u0024 to $
-> compiled string contains ${IFS}
-> sh -c expands ${IFS}

This bypass requires a later Java-compilation step. A normal Java string received at runtime does not reinterpret the six characters \u0024 as $.

_{Find by: java, unicode escape, unicode translation, u0024, dollar filter bypass, literal character filter, compiled java source, h2 create alias, ifs · Source: HTB/PentestNotes}

Preserve a shell command with Runtime.exec(String[])

Runtime.exec(String) splits a command string into tokens. It does not apply shell quoting, redirection, pipes, or variable expansion by itself.

String command = "sh -c id > /tmp/output.txt";
Process process = Runtime.getRuntime().exec(command);
process.waitFor();

The string form can pass id, >, and /tmp/output.txt as separate arguments to sh -c instead of preserving the complete shell expression as the command handled by -c.

The array form preserves the command as one argument:

String command = "id > /tmp/output.txt";
String[] commandParts = {"sh", "-c", command};
Process process = Runtime.getRuntime().exec(commandParts);
process.waitFor();

The resulting arguments are:

argv[0] -> sh
argv[1] -> -c
argv[2] -> id > /tmp/output.txt

The shell therefore handles the redirection contained in argv[2].

_{Find by: java, runtime exec, exec string array, process, sh c, shell command, preserve arguments, redirection, pipe, command execution · Source: HTB/PentestNotes}