drewmnoel

 internal static class FormsAuthenticationTicketHelper
    {

        private const byte CURRENT_TICKET_SERIALIZED_VERSION = 0x01;
        private const int MAX_TICKET_LENGTH = 4096;

        // Resurrects a FormsAuthenticationTicket from its serialized blob representation.
        // The input blob must be unsigned and unencrypted. This function returns null if
        // the serialized ticket format is invalid. The caller must also verify that the
        // ticket is still valid, as this method doesn't check expiration.

drewmnoel

#!/bin/bash

# Vuln via: scp /etc/passwd temp@localhost:'`touch /tmp/exploit2.sh`/targetfile'
set -f
set -- $SSH_ORIGINAL_COMMAND

# This replicates a really bad filter
case "$1" in
  'ssh*')
    >&2 echo "Access denied"