-1

I found it here: https://netsec.ws/?p=337

echo os.system('/bin/bash')

os.system is from python but echo is not, I think... what language is this exactly?

SilenceOnTheWire
  • 189
  • 1
  • 9
  • 1
    It's a *pen testing list*; presumably the `echo` is piped to something that the tester hopes will run the code. – Martijn Pieters Aug 21 '17 at 17:26
  • In other words, it's just one part, coded in `sh`, where the echoed result is to be executed by something else, perhaps the current shell implementation. – Martijn Pieters Aug 21 '17 at 17:27
  • Yeah, that is a shell script to see if whatever it's hooked up to is talking to a Python interpreter that will execute the `os.system()` bit. – kindall Aug 21 '17 at 17:28
  • 1
    It can't be a shell script - at least not bash/dash/zsh - because of the parentheses. You would get a syntax error. – user1934428 Aug 22 '17 at 10:12
  • It's a shell script because of the `echo`. The `echo` sends a Python command to whatever `stdout` is connected to, hoping it's a Python interpreter. – kindall Aug 23 '17 at 16:22

1 Answers1

1

If you looked at the echo tag, you'll see its description: "Simple function outputting text. Exists in script languages.", if you're running Linux or Mac and even Windows Command Prompt you can enter this:

$ echo Hello shell world

Output:

Hello shell world

echo is useful for testing shell glob expansion, echoing the values of environment variables and sending output to stdins of other programs, for example try this with Bash:

$ echo 'print("Spam" * 2)' | python -

Output:

SpamSpam

And this: 

$ echo 'import os; os.system("echo SPAM")' | python -

Output: 

SPAM
GIZ
  • 4,409
  • 1
  • 24
  • 43