PortSwigger OS Command Injection Lab-1 | Simple case

OS command injection is a very simple and good vulnerability. If you get it, you will become a very rich vulnerability. Because what happens in this is that you don't have to explain much in terms of name. The application takes the user's input.

somehow it takes it to a command in the backend, runs it, processes it and shows its output. Now what you can do is, you can inject your own malicious command in between. So your data is being taken directly, it is reaching the command prompt. Now it can be somewhere in between a command. You have to figure out how you will inject your command in such a way that your command is executed and its output is also seen. This you have to manage here.

If we see a simple example of this, wait a minute, ok, if I hit enter, no, it will show below, there is no other way. So if I talk to you, what happens in command injection, for example, there is a command ping 127.0.0.1, or let's leave this,

So basically what that website is doing taking your user input appending that user input

in this particular command ping command ping -c4 -c is count ping 4 times ping 4 times 4 icmp packets see if the reply is coming or not and whatever ip address you provide in the user input field it is appended here and its output that is directly displayed to you okay now what you can write here that

your command, I don't want to run ping but execute your command what you can do ok so here you can experiment with different things that basically what you have to achieve here is you have to multi

multiple commands execute in a single line multiple commands you have to execute in a single line so you have to achieve this so how you can do this you have to figure out this using different techniques there are different techniques here for example like jayateviyari said that we can use a semicolon semicolon is for line ending

Bash is a programming language, like JavaScript, C++, how do you mark the end of a line in each language? There is a line end, you put a semicolon, correct? Similarly, you can do it here too. So what will I do? What input will I give as a user input? Now you know that it is running in the background, ping -c4, okay? What if I put this input as a user? 0.0.1 line end id. I put this input in the application. We will copy it and

I will go over there and paste this particular thing which I have done here. Enter my address and this is the output I am going to get on my application. So you have seen my UID here. Okay. There are many more ways. Like what I can do is also I can use

and single pipe sign and after that it is OR basically it is OR so what I am saying here is that run ping, the unique hacker told us that it should not work now what happened here

wait a minute, what else was there in this? no no no, I said wrong, I said wrong, ok, I will tell you how this works, ok so this single, this sign is called pipe, this sign is pipe, ok so what is pipe doing here? first of all ping is executed

whatever output of ping comes, whatever it wants to write, will go to the in of the id command. So basically what we are doing here is that the output of this will go directly into the input of id. But id doesn't matter, so whatever input we get, it will show the output of id command.

everyone knows that pipe is basic, you must have used graph a lot of times with graph so basically if I am writing ping command then ping will be executed first but the output of ping went inside the id command as input now id command doesn't need any input so it ignored it and we saw the output of id directly now moving on, unic hacker has told us one more thing

That is an end sign. What does end do? Can anyone tell me what does end do here?

Now, what does single end do here? The first command makes it background. The first command makes its output background. Now, it used to work before, now it doesn't work. Why? Because it made ping background. It made ping background and revealed its process id. But even after that, its output is showing here. So, what did it do before? If you would give a sign of end in front of any command, then its output would go to the background, we couldn't see it.

Now this is not working anymore with bash because if you give end, it shows process id and still shows its output. Plus, what will happen with this? This went to background. Plus, this also helps us that if you want to run any other command after this, you can give that too. And if I give end after id, it will also background id but the thing is that earlier it used to background, now it doesn't background, it will still show the output of id.

It runs the command and shows its output in the background but it does not work anymore. I am giving you a disclaimer here. As you saw, it showed ping as background and this is its id. But then it started showing its output again. So, it used to do this work earlier but now it doesn't.

double end double end works like this in every programming language there is and or or in every programming language we haven't seen or till now so what does end do? if both the conditions are true then only it will work if I tell you this you have to be very careful with this if you are running a command like this let's say I give it hello and then I give end end

id so see what will happen both commands will not run because andy has a condition that if both situations are true then it will run both commands will only run when both commands will not get any error because if there is an error in ping then this command will not run here if i fix it same 127 127.0.0.1 let's hit enter

and here as ping is an executor, so id is also an executor because the end key is that both conditions will be true then only it will work

Now if you are interacting with me, you will also understand. Now both unique hacker and jay tiwari gave me OR. This is the OR of bash. What does OR means? This condition will be true or this condition will be true. If any of the two conditions is true, then it will run both. I don't know how its behavior will be. I will have to see.

No, what it is doing is that if the first condition is getting true, then it is running only that. But basically its logic is that

It means that if any of the two is true, then it will return true. So it checks the first condition by running that what is working. If it is working, then it runs this. It gives a true situation that it is true and move ahead. It ignores it because it needs one true. It doesn't matter if it is found by anyone. But if I do this here, it means that I put hello here, I give error. So now the id will work.

Now here id, why? Because it tried ping, but ping gave false, it didn't work, so it went to id and tried id. If you make ping work before itself, then you will have to remember that the symbol you are using, according to that command injection. If you make the first command, ping command wrong in the end, it will give error, then id will not run malicious command, same in all. If you gave the first one in all correctly, then your id command will not run, you have to remember this. Okay. Now we have one more way, okay.

what we can do here for example, I am thinking to show you how to use it I don't know if it will work or not, let's see if I tell you a command which has an argument, I mean we have to give something like ping, so if I try this ping, and instead of directly giving 127, what if I give this

echo 127.0.0.1 ok so basically you can execute other commands in one command also those who don't know you can execute other commands in one command also like what i did here pinged now see the output of this command whatever sign we call this

What do we call it? Backticks. These are backticks in between backticks. The one below escape key is a backtick. So if you give anything in between backticks, then the first thing to execute will be that thing. The rule of board mass is that the first brackets are run. Similarly, here is a rule of bash. Whatever comes in backticks, like you give b in board mass, similarly, here also you assume that the b of board mass is backticks. So whatever will be in backticks will be executed first.

So here if you see what will be the output of echo 127.0.0.1? Its output will be 127.0.0.1 correct? This will be the output and it will be connected to ping. Let's enter and see.

Now see, it is ping 127.0. Although I didn't give it 127.0.0.1, but still it is being pinged. Why? Because first of all, this command was run, its output is 127. So its output will be added here, it will be replaced instead of backticks. You can run another command in one command and then its output will be replaced here. Its output is here. Similarly, how can we do command execution in this way? Now suppose I was asking for IP, so what could I give here? ID. Now see what will happen.

we have to find a command where we have execution like echo no echo not what can we try in error of ping error we can't see then we have to do something like this 127.0.0.1 and let's try this may be it will work or not

so basically what I am doing here is doing error based command injection I want this id output to be seen in error so for this it will only work if this technique like we did in echo if you try with echo then I think cannot resolve host id but I think this will not execute I don't know if double backticks works or not I am trying with you but I don't know if it will work like this

and I give id and close backticks you can't give backticks in backticks this technique is not working here as I thought we can generate it error based but it will work in those commands where error shows that what you have put is wrong so what I was putting here is id output if the output of id shows that the ip address you have put is wrong then we get help which it is not doing here

if you see when I am giving backticks here it is displaying here that unknown cannot resolve id here it is saying cannot resolve id but it is not saying here that cannot resolve id's output this is because maybe if someone sees special characters then it does not display maybe for any reason but because of this it is not coming here which is not a big problem I guess ok but you understood how backticks can be used to run any command inside another command

Is it clear to everyone? This is an old version of this. This is a new version. This is a new version. Backticks came in the batch a while ago. Before this, an old version of this was used. I will show you that version as well. See. Ping -c 4. This was an old version but the batch still supports it. Dollar sign, brackets and you can give commands in between. Okay. Like here we give echo 127.0. This will also work with the backticks.

Whatever is in brackets, it is the same rule of the board mask. Whether it is backticks or brackets, whatever is in between these brackets, whatever is in between dollar brackets, whatever is the command, first of all, it will be executed. The output of this will replace the whole, that is 127. And then it will ping 127. See, it worked in the same way. Okay. So, it also works in the same way. This method is done. Like backticks works, this also works. You can also do command injection with this. And I have a cool technique for you because you are following so many people. So, I will show you a technique too.

dollar id what happened to it? if I write dollar id, dollar is basically used for variables so if I write a=4 in bash and then I write $a then I will get 4 commands basically if I write dollar id then it will not take id command then it will think id is a variable name so that will be a different thing that you are saying dollar after ping let's write this too so ping -c 4127.0.0.1 dollar id

what happened to this? or if you want an id then I will try that too nothing will happen, ok so, all of this is clear now I will show you a cool technique yes I understood, I have already shown this take this

here it is saying write id, i didn't show it what happened, nothing happened because it is checking if it is a multi line output or a very long output then ping is saying no to display error it knows that it might have put protection against error based command injection for any reason but because you are there now, i will show you a good technique many times what happens is, command injection is running, how to protect it now how do people protect it many times

the strings of commands like no one can write whoami no one can do these types of things so in this case there is a big problem that what is bypass

I have blocked only who mi, your task is to run who mi command, you are playing CTF, who mi is blocked. Who mi string is not working, so how can you take bypass, it is very easy to take bypass, blacklisting is done. I am not explaining in simple language, I have done technical term blacklisting. So you can write who mi string only, you can't write who mi. But you have to run who mi command, so see this simple, who, then what do I write here, I give a blank command, blank mi.

so basically what I took here I gave a blank string in the middle now who is different and mi is different so it is not together who is blocking who is mi but now it is different so who is mi will not block it you can do protection with the same backticks

or you can try this method of putting echo A in between. I have not tried this yet. See, it worked. Because I put echo A in between. So, who is separated, A will be echo and it will say MI. It is a great way to put bypasses. Now, we will come here and now we will go to our labs. Let's start doing one by one.

OS command injection simple case, the most basic OS command injection. This lab contains an OS command injection vulnerability in the product stock checker. Remember this. I find this a bit useless. Make the lab a bit realistic. What command injection is found in the stock check feature? I mean, if there is a functionality where it is said that the command is going here, it can be. But okay. To solve the error, execute the whoami command to determine the current user name. Access the lab.

environment variables.

how to use characters, if you have made any special aliases, aliases can also be seen. Many things are in environment variable. One of them is environment variable, user, path, and for different environment, for temp folder also environment variable is there. Many environment variables are made for your use. So, those who have not used environment variable till now, they can use it. Their work will be very easy. Ok, let's go here. OS command injection's lab has opened. View details. Check stock feature.

and this is 62, lets go here, what is to be updated, which we will not do now, we will do it later, what is here, this is the new introduced, they have introduced something new, burp intruder capture filter, automatic decoding of SMTP messages in burp collaborator and improved accuracy of recorded, we will see later what they have released, but stock check feature is here, send to repeater, stock id, lets see send here,

We will try the payload that we have learned till now. How will we know when the lab is solved? It is done.

Ok, you don't have to do anything, 1 was directly injected into a command, I added an extra command in the backend, I entered the command and it solved. Ok, sometimes, what happens is, for those of you who don't know, let's assume, whatever command I'm inputting, for example, the command was something like this, let me think, like the command was something like this, ping, for example, ping -c, and you have to add the 4 value, after that, it becomes 1.27, basically, your input is going here.

your input is going here, for example, if you are able to put input in fort, then what is the problem if I put some input, suppose I put a command like whoam I, for example, whoam I

I put it in any command and now that command is in argument. This command is like this. I put 1 here. For example, I put the input of 1. It went like this. This command ended here and there was an error. And our whoami. Now the problem is that if whoami starts giving error that you have added 127 later. So it has two solutions. That if you have the appended part, it can be more than two solutions basically. Simple solution is that you can either comment out the part later.

So for commenting in bash you take the use of hash sign like in python So you can write hash to this, after whoami give hash and it will be commented in the future Or you can do your line end here So error will come in this

error will come in this line but this line will end then whoami will be executed and this line will end here then error will come in this line that 127 is not a real command error will come in this also no problem but whoami will be executed so you can do this technique you can give more if you want to give because this will also be false this is not a valid command this will also be false this is also not a valid command so this will also be false so you can give like this also whoami

So you can see that this command is also false, so this will also not execute. Because we have given OR, so it will go to whoami and execute whoami. Then this is also false, so there is no tension. You can use this type of technique. If some part is being appended and the command is not running properly.