Command Injection
Contents
Overview
A Command Injection vulnerability occurs when unsanitized user input is passed to a system shell (system(), exec() etc).
UNIX
Consider this simple script which displays the output of the UNIX whois command:
<syntaxhighlight lang="php"> <?php $whois=system("whois $_GET['domain']"); echo($whois); ?> </syntaxhighlight>
On a UNIX shell, commands can be injected in a number of ways. Using a semicolon, which delimits commands:
cd ~; ls
Using an ampersand, a control operator:
cd ~ && ls
Using a pipe, a bash operator for stringing commands together:
ls | grep filename
Or using backticks or a $ for command substitution
ls /home/$(whoami)
or
ls /home/`whoami`
An attacker could use any of these to inject and execute a command using the above script by requesting:
/whois.php?domain=www.google.com;cat /etc/passwd
Windows
Perl
A slightly lesser known command injection technique uses Perl's open() function. This is useful for exploiting CGI scripts.
In addition to system() and exec(), Perl's open() function can also execute commands, because it is used to open pipes. In this case, you can use | as a delimiter, because Perl looks for | to indicate that open() is opening a pipe. An attacker can hijack an open() call which otherwise would not even execute a command by adding a | to his query.
|
Command Injection Visit the Web Exploitation Portal for complete coverage.
|
