# Command Injection

**Task 1: Introduction (What is Command Injection?)**&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FRvft3WpZzl2E3weiGhYT%2Fimage.png?alt=media&#x26;token=4b34ca10-0e20-4cc7-b354-dac96b19d0d2" alt=""><figcaption></figcaption></figure>

**Task 2: Discovering Command Injection**

For this task we just have to read the PHP code snippet in the given example

* $songs - it is a variable that holds the value "/var/www/html/songs"&#x20;
* $title - it will get the user input from the website&#x20;
* $command - this variable will use the grep command in the system and it will take the $title variable from the user's input and it will search the word in the "/var/www/html/songtitle.txt"&#x20;
* $search - it will use the exec() function in the php and will use the $command as its argument&#x20;
* Then the if-else statement will determine if the search holds nothing for its value then it will return "not exist!". Otherwise, it goes to the else portion where it will return "does exist!"

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FmOdWYkbS8ytwE6ZayP11%2Fimage.png?alt=media&#x26;token=968bb2d9-821b-4905-ad27-90e95a030cb5" alt=""><figcaption></figcaption></figure>

* First they imported the subprocess lib
* Then just creates a app variable that holds the flask name
* They created a execute\_command function that will executes command in the server
* The @app.route will just direct the users to /shell directory&#x20;
* After that the last function will just execute the command&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fae4Q4YWEcNIamwyFFcBX%2Fimage.png?alt=media&#x26;token=a77d956c-f7d1-4c22-9368-7a89af5889a4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FOUIVGt40FFyb9Lwd1i6z%2Fimage.png?alt=media&#x26;token=3ed8409b-9f22-42f8-a746-6a27d81c912e" alt=""><figcaption></figcaption></figure>

**Task 3: Exploiting Command Injection**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FmCnISiYp3SY1MNRntVJ6%2Fimage.png?alt=media&#x26;token=17fa307e-b473-42db-8a9d-8434075f4a13" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FoG0pXbvcMAF8G37w4je2%2Fimage.png?alt=media&#x26;token=01e4527d-37f1-4e63-acb1-92ae1d443816" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F4DdwgBFuhxNo6KqWBcWk%2Fimage.png?alt=media&#x26;token=91154e9f-73b9-4e7c-a057-8fe98f5a2c3e" alt=""><figcaption></figcaption></figure>

Task 4: Remediating Command Injection

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FbX0MBHiXL80zDzdbm7w3%2Fimage.png?alt=media&#x26;token=7eb90290-3b9a-4c9b-a779-d02b05fa7d3d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FBmMcOHeXmMgJjm8PWR15%2Fimage.png?alt=media&#x26;token=95d045bf-7468-404a-a314-fca318c6850b" alt=""><figcaption></figcaption></figure>

**Task 5: Practical: Command Injection (Deploy)**&#x20;

First we just have to try the input box and test what is the output for this. As we can see here, it actually returns the result from the <mark style="color:blue;">ping</mark> command.&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FtpwibGidEQWrHW16cddx%2Fimage.png?alt=media&#x26;token=79278104-9c5a-4d57-92b2-2aa513f2c04f" alt=""><figcaption></figcaption></figure>

Just by knowing the input box are actually taking real commands and it executes in the server. We could try some Command Injection in the box. The input box actually accepts the ";" command.

So, we can just try to execute 2 commands at the same time.&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F90T1mlziT4VYA8dsDuea%2Fimage.png?alt=media&#x26;token=a4a030fb-0ef6-4375-8c3d-9e1099f31637" alt=""><figcaption></figcaption></figure>

For the next question we will get the answer by trying out this command.&#x20;

```
127.0.0.1 && cat /home/tryhackme/flag.txt
```

First we know that the first command will ping the IP address that we will enter in the input box then we are going to use the double ampersand which is this "&&". This will execute the first command and after that will also execute the second command that we will enter.

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fx8kjj9gRswpeQuefG8Vq%2Fimage.png?alt=media&#x26;token=21245e1e-3932-4876-bb2d-eb20c09fb93c" alt=""><figcaption></figcaption></figure>

**Task 6: Conclusion**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FGmyJpizB5LjVByS9Fn8t%2Fimage.png?alt=media&#x26;token=5675096d-accc-430e-be46-3de4b69c9854" alt=""><figcaption></figcaption></figure>
