PortSwiggerlabs: OS command injection, simple case

Scenario :

This lab contains an OS command injection vulnerability in the product stock checker.

The application executes a shell command containing user-supplied product and store IDs, and returns the raw output from the command in its response.

To solve the lab, execute the whoami command to determine the name of the current user.

Solution :

As the name implies , “simple case” , this will be a simple lab , no WAF , no filters nothing that will block us :)

Now first , we navigate the app , then check Burp’s History as always .

We’re mainly looking for a parameter that we can inject :

We get the Product ID parameter that changes depending on each product we select .

Usually whenever we get a parameter it’s always good to test all Injections (SQLi,XSS,…) but in our case we will focus on Command Injection Only .

What we’re hoping for is that the parameter being passed to the server gets placed inside a system command (or passed to a function that executes shell commands), so the server ends up running our input as part of a command.

So to abuse this we can add a command injection payload to make it so that it executes an additional command .

there are plenty of command injection payloads that we can use .

We will use something that works for both Linux and Windows :

||

Product ID was not vulnerable -_- .

Now if we check the Stock on different stores :

We get a POST request , containing 2 parameters :

I will start with the Store ID parameter since the Product ID didn’t seem to be vulnerable .

First a simple payload to see if it will break anything :

%7c ==> Encoded value for |

Now let’s add our command and check if this works :

And it worked perfectly .

Now going back to the lab , it should be solved .

That was all for this lab , see you in the next one :)