This method or attack is the most severe and common form of attack according to the OWASP Top 10 list. It is also perhaps the most interesting attack I’ve ever done from my limited experience. A quick definition from OWASP follows:
Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.
1. Probing
So the DVWA command injection page looks like this:
(Note: the links in the More Information section are REALLY helpful).
So quickly testing with a valid IP address:
And with an invalid address:
I also tried inputing nothing and pressing submit:
So this this shows that the application simply passes our input as an argument to the console command ping. i.e. it executes “ping [input]” and we see that output of our command in red. If it doesnt work, then nothing happens.
2. Chaning Commands
We can execute more commands after our input by chaining them. Different operating systems will use different characters to chain. In linux, we can use ‘;’ to make commands run sequenctially or ‘&’ to make a command run in te background, In Windows, we can simply use ‘&’. If ‘;’ doesnt work, then we can conclude that the OS is Windows and vice versa.
3. Command Injection Attack
Basically, if the app doesn’t have any delimeter or character bans (to prevent ';' '&' or '|') then we can simply trick the app to continue executing any of the commands we want.
So a basic attack string would be
127.0.0.1 & hostname
Now it turns out you can run basically anything according to the OS. A bunch of other commands I tried was cd, dir, mkdir, del, echo, more, ipconfig, find, and whoami?
This was the output after making a directory called ‘hello’:
It was also interesting to see that localhost and ::1 were valid ping adresses. But I am no computer expert so I have no idea why these are valid.
