bad-wrapper.sh

#!/bin/bash

# Vuln via: scp /etc/passwd temp@localhost:'`touch /tmp/exploit2.sh`/targetfile'
set -f
set -- $SSH_ORIGINAL_COMMAND

# This replicates a really bad filter
case "$1" in
  'ssh*')
    >&2 echo "Access denied"
    exit -1
esac

# The actual "vuln" is here. -t did not sanitize the contents of $SSH_ORIGINAL_COMMAND
# So when we eval it in Bash, it.. evals as Bash and we trigger the backtick expression first.
eval $@