Comtrend-AR-5310 – Restricted Shell Escape
Comtrend AR 5310 routers have a restricted shell, the list of command a user can execute is [ ? help logout exit quit reboot ads lxdslctl xtm loglevel logdest virtualserver ddns dumpcfg dumpmdm meminfo psp dumpsysinfo dnsproxy syslog ifconfig ping sntp sysinfo tftp wlan wlctl vlanctl arp defaultgateway dhcpserver dns lan lanhosts passwd ppp restoredefault route nslookup traceroute save uptime exitOnIdle wan build version serialnumber modelname acccntr upnp urlfilter timeres tr69cfg logouttime ipneigh dhcp6sinfo nat mcpctl ]. Usual terminal constructs like the command separator ';', the control operator '&' (run in forground), the redirection operator (pipe) '|', the command substitution operator '`' are all filtered. Still the $ operator is not filtered, so invoking a command with $( subcommand ) as argument would give an obvious shell.
