ichikaway

<?php

namespace App\Console\Commands;

use Illuminate\Console\Command;

class SampleCmd extends Command
{
    /**
     * The name and signature of the console command.

ichikaway

<?php

require 'PHPMailerAutoload.php';

//$address = '[email protected]';
$address = '"attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php  some"@email.com';

var_dump(PHPMailer::validateAddress($address));

ichikaway

<?php

$address = "aaa bb cc";
echo escapeshellarg($address) . PHP_EOL; // 'aaa bb cc'

echo "----------------\n";


//CVE-2016-10045
$address = "\"attacker\' -oQ/tmp/ -X/tmp/phpmailertest/phpcode.php  some\"@email.com";

ichikaway

package install

sudo apt-get install gawk
sudo apt-get install bison
sudo apt-get install make
sudo apt-get install gcc
sudo apt-get install bzip2
sudo apt-get install g++
sudo apt-get install texinfo

ichikaway

bash parser sample with docker

https://github.com/vorpaljs/bash-parser

docker pull node:8.9.4-alpine
docker run -d --name node-alpine -it node:8.9.4-alpine
docker exec -it node-alpine /bin/sh

vi sample.js

ichikaway

function FindProxyForURL(url, host)
{ 
  if(shExpMatch(host,"www.example.com"))
  {return "PROXY 54.92.84.100:28888";}
  else 
  return "DIRECT";
}