OS command injection occurs when application code builds an operating-system command from untrusted input and hands it to the OS in a way that lets the attacker change which program runs, or with what arguments. The usual payoff is remote code execution in the context of the service account.
The subtree separates the mechanisms from everything built on top of them: chaining with shell separators, command substitution, and argument (argv/flag) injection with no shell are the ways in; exfiltration covers blind, out-of-band data recovery; and filter bypass covers evading blocklists and WAFs.
Subtopics#
- Argument: A user value lands in argv and the called binary re-parses it as an option rather than data, no shell, no new process, yet file read/write and code execution.
- Chaining: Shell control operators that let an injected value terminate the intended command and start another: ; && || and &.
- Exfiltration: Recovering output when none is returned: time-based oracles and out-of-band DNS/HTTP channels.
- Filter bypass: Blocklists and WAFs are evaded because the shell normalizes a payload after the filter inspects it, grouped by what each technique defeats.
- Substitution: Backticks and $(...) run a nested command and splice its output into the current command line, even mid-argument.
Tools#
- commix: automated command-injection detection and exploitation.
- Burp Suite: Repeater and Intruder for injecting and confirming payloads.
- interactsh: out-of-band callback capture for blind cases.