Run a bash command with user input You still need to quote substitutions to prevent word-splitting. Word-splitting is a feature, not a vuln. Substitutions use variables to prevent shell injection.

Microsoft might not intend for the Bash shell to be used this way, but that shouldn't stop geeks from mining its potential.

Reverse Shell with BASH This technique is for when netcat isn't available on the remote machine and when you want to leave a small footprint when you're doing things of a questionable nature.