🚧 Command Injection Attack

Introduction

In this lab, we will learn about command injection attacks, a commonly exploited vulnerability in web applications. The goal of this lab is to understand how command injection attacks work, and how to prevent them from happening in your web applications.

Introduction to Command Injection

In this step, we will introduce the concept of command injection attacks.

Command injection is a type of attack that occurs when untrusted data is passed to a system shell or command, allowing an attacker to execute arbitrary commands on the host operating system. This can lead to data leakage, system compromise, and even complete system takeover.

Here's an example of a vulnerable PHP code:

<?php
$ip = $_GET['ip'];
$output = shell_exec('ping -c 3 ' . $ip);
echo "<pre>$output</pre>";
?>

In this code, the $ip variable is directly concatenated with the ping command, allowing an attacker to inject malicious commands by providing a crafted input.

Exploiting Command Injection

In this step, we will learn how to exploit a command injection vulnerability.

Let's assume we have a vulnerable web application that allows us to execute the ping command with a user-provided IP address. We can inject additional commands by using special characters like ; (semicolon) or && (AND operator).

For example, if we input 127.0.0.1; ls in the IP field, the application will execute both the ping command and the ls command, revealing the content of the current directory.

$ curl 'http://vulnerable.example.com/ping.php?ip=127.0.0.1;%20ls'
PONG 127.0.0.1 (127.0.0.1)
index.php
ping.php
style.css

We can also use the && operator to chain multiple commands together:

$ curl 'http://vulnerable.example.com/ping.php?ip=127.0.0.1%20&&%20cat%20/etc/passwd'
PONG 127.0.0.1 (127.0.0.1)
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

This way, an attacker can potentially gain unauthorized access to sensitive data or even take control of the system.

Preventing Command Injection

In this step, we will learn how to prevent command injection attacks.

The most effective way to prevent command injection is to avoid executing user-provided data as part of a command or shell script. Instead, use language-specific mechanisms for executing commands and sanitize user input before using it.

Here's an example of a secure PHP code that sanitizes user input:

<?php
$ip = filter_var($_GET['ip'], FILTER_VALIDATE_IP);
if ($ip !== false) {
    $output = shell_exec('ping -c 3 ' . escapeshellarg($ip));
    echo "<pre>$output</pre>";
} else {
    echo "Invalid IP address";
}
?>

In this code, we first validate the user input using the filter_var function to ensure it is a valid IP address. Then, we use the escapeshellarg function to escape any special characters in the input before passing it to the shell_exec function.

This way, even if an attacker tries to inject malicious commands, they will be properly escaped and treated as literal data, preventing command injection attacks.

Summary

In this lab, we learned about command injection attacks, a common vulnerability in web applications that allow untrusted data to be passed to system shells or commands. We explored how to exploit command injection vulnerabilities by injecting malicious commands using special characters like ; and &&. Finally, we learned how to prevent command injection attacks by validating and sanitizing user input before executing commands. By implementing proper input validation and using language-specific mechanisms for executing commands, we can effectively mitigate the risk of command injection attacks in our web applications.