Repair quoting, encoding and command-length boundaries

Needs: Known outer request/template/database parser and inner shell; correct character encoding and transport length

Write the real chain

# Write the real chain
document/shortcut or HTTP/SQL/template input
→ application parser
→ VBA/WScript/application runtime
→ cmd.exe /c, /bin/sh -c or PowerShell
→ final command/payload

PowerShell encoded-command preparation

# PowerShell encoded-command preparation
$command = 'COMMAND'
$bytes = [Text.Encoding]::Unicode.GetBytes($command)
[Convert]::ToBase64String($bytes)

Windows commands

REM Baseline
powershell.exe -NoProfile -NonInteractive -EncodedCommand BASE64_UTF16LE

Write the parser chain explicitly

# Write the parser chain explicitly
HTTP/SQL/template parser
→ application language
→ command launcher (`system`, `cmd /c`, `/bin/sh -c`, PowerShell)
→ target shell/interpreter
→ payload command

Encode only for the layer that consumes the characters

Test each layer with a small command. Encode only for the layer that consumes the characters:

# Encode only for the layer that consumes the characters
python3 -c 'import urllib.parse; print(urllib.parse.quote("COMMAND"))'

Verify → Verify received/executed command behavior at each parser boundary with small discriminating tests.

If it fails → Truncation, double decoding or mismatched shell syntax should not be treated as missing network connectivity. More detail ↓

If → then

An input appears in a command-like operation or causes shell-dependent behavior → Prove visible or blind operating-system command injection
Needs: Input reaches command execution with an exploitable parsing boundary; process identity/runtime can perform the selected proof
Linux command execution exists but an interactive channel is needed → Connect a Linux reverse shell through an available interpreter
Needs: A confirmed Bash/Python/PHP/Netcat implementation, correct parser wrapping, target-to-listener route and compatible listener
Windows execution or valid credentials with an available remote service → Use Windows authenticated access or a PowerShell command channel
Needs: Accepted remote-service rights or compatible PowerShell execution; correct encoding, policy context and callback route

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Repair quoting, encoding and command-length boundaries

USE WHEN: A simple command works while a longer or nested payload fails
STARTING ACCESS: A recorded delivery/execution chain with the expected consumer and effect
RESULT: A command representation that survives every required parser

Recognize the clue

Compare the last working simple command with the first added quoting/encoding layer; record which parser receives each representation.

curl -skG --data-urlencode 'PARAM=NORMAL_VALUE' http://TARGET:PORT/PATH

SYNTHETIC EXAMPLE OUTPUT

Simple id command: expected output
Added Bash redirection through sh: syntax error

Means: The break follows a shell-language/representation change, so network or exploit applicability need not have changed.

Confirm: Confirm outer decoding, actual inner shell, length and correct byte/string encoding with a small test.

After validation: The exact command survives every parser and its bounded effect is verified: use that representation.
Ruled out in this context: The selected shell does not implement the payload syntax: reject that unwrapped expression.
Still inconclusive: A generic server error without received/executed-command evidence needs a smaller discriminating test.

Troubleshooting: Truncation, double decoding or mismatched shell syntax should not be treated as missing network connectivity.

Additional prerequisite checks

$command = 'whoami'
[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($command))

Write the real chain:

Start with a short marker at every layer. Check:

quote ownership at each layer;
expansion of %VAR%, $VAR and PowerShell variables;
metacharacters such as &, |, <, >, ;, backticks and parentheses;
URL/JSON/XML/Base64 decode count;
command-line, VBA-string, request-field or exploit-buffer length;
current directory and relative paths.

PowerShell encoded-command preparation:

-EncodedCommand uses UTF-16LE. It solves some transport/quoting problems; it is not encryption and does not establish antimalware evasion.

Write the parser chain explicitly:

Test each layer with a small command. Encode only for the layer that consumes the characters:

Typical failures:

&, |, >, <, $, backticks, quotes or spaces consumed by an outer shell;
URL decoding occurs zero, one or two times;
JSON, XML, SQL or template quoting changes the command;
PowerShell receives UTF-8 Base64 instead of required UTF-16LE;
payload length exceeds a field, command line or exploit buffer;
32-bit payload is injected into a 64-bit context or the reverse.

Why it works

HTTP encoding, shell quoting, PowerShell UTF-16LE encoding and application string escaping solve different transformations. Encoding is not encryption or an endpoint-control bypass.

Worked example · hypothetical

Observation: a Bash redirection fails through an application using sh. Test: wrap the Bash-specific expression in the intended interpreter and correctly encode the outer request. Illustrative output: the minimal command succeeds. Interpretation: add the connection step only after parser proof.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗