Command Injection
Theory
Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell.
In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.
Practice
Tools
Commix (python) is a tool that automate Command Injection detection and exploitation.
# With a request file
## Batch : do not ask for questions
## --os : specify OS if known
## -r : request file
commix -r request.req --batch --os=Unix
# Retreive all
# --all : Retrieve everything
# -u : Target URL
commix -u <TARGET_URL> --allFuzzing
We have to identify input vectors that may not be properly sanitized in GET and POST parameters. For this, we may fuzz parameters with following wordlists and tools.
We can use ffuf and the command-injection-commix or command_injection wordlists.
Payloads
In Unix-like command-line interfaces, the -- symbol is used to signify the end of command options. After --, all arguments are treated as filenames and arguments, and not as options.
Following payloads are both Unix and Windows supported
;(Semicolon): Allows you to execute multiple commands sequentially.&&(AND): Execute the second command only if the first command succeeds (returns a zero exit status).||(OR): Execute the second command only if the first command fails (returns a non-zero exit status).&(Background): Execute the command in the background, allowing the user to continue using the shell.|(Pipe): Takes the output of the first command and uses it as the input for the second command.
Following payloads are only unix supported
Filter Bypass
IFS
$IFS is a special shell variable called the Internal Field Separator. By default, in many shells, it contains whitespace characters (space, tab, newline). When used in a command, the shell will interpret $IFS as a space. $IFS does not directly work as a seperator in commands like ls, wget; use ${IFS} instead.
Brace expansion
In some shells, brace expansion generates arbitrary strings. When executed, the shell will treat the items inside the braces as separate commands or arguments.
Redirection
Input redirection. The < character tells the shell to read the contents of the file specified.
ANSI-C Quoting
Tab character
The tab character can sometimes be used as an alternative to spaces. In ASCII, the tab character is represented by the hexadecimal value 09.
Windows Operations
In Windows, %VARIABLE:~start,length% is a syntax used for substring operations on environment variables.
Commands can be broken into parts by using backslash followed by a newline
URL encoded form would look like this:
We may use hexadecimal encoding in order to bypass filters
Commands execution without backslash and slash - linux bash
We may bypass blacklisted words as follow :
Bypass with single quote
Bypass with double quote
Bypass with backslash and slash
Bypass with $@
$0: Refers to the name of the script if it's being run as a script. If you're in an interactive shell session, $0 will typically give the name of the shell.
Bypass with $()
Bypass with variable expansion
Bypass with wildcards
Data Exfiltration
We may extract data char by char
For DNS based exfiltration, you may see this page.
Polyglot command injection
A polyglot is a piece of code that is valid and executable in multiple programming languages or environments simultaneously. When we talk about "polyglot command injection," we're referring to an injection payload that can be executed in multiple contexts or environments.
Resources
Last updated
Was this helpful?