PortSwiggerlabs: Blind OS command injection with time delays

Scenario :

This lab contains a blind OS command injection vulnerability in the feedback function.

The application executes a shell command containing the user-supplied details. The output from the command is not returned in the response.

To solve the lab, exploit the blind OS command injection vulnerability to cause a 10 second delay.

Solution :

First we start by navigating the app just like a normal user, from there we check Burp’s History .

We’re mainly looking for parameters where we can inject , whether in a POST or GET request (Mainly POST since that’s what we’re sending to the server ) .

Usually whenever we get a parameter it’s always good to test all Injections (SQLi,XSS,…) but in our case we will focus on Command Injection Only .

Since this is a Command injection , what we’re hoping for is that the parameter being passed to the server gets placed inside a system command (or passed to a function that executes shell commands), so the server ends up running our input as part of a command.

So to abuse this we can add a command injection payload to make it so that it executes an additional command .

there are plenty of command injection payloads that we can use .

We will use something that works for both Linux and Windows :

||

We find this endpoint , where we can submit our feed back .

This is the POST request that we’re looking for .

The problem is , we don’t get anything back . So even if we have a command injection , we can’t see the output , so how would we know ?

We can inject commands that will cause time delay .

sleep 10
ping -c 10 127.0.0.1

Both of these will take 10 sec to finish which will result in a delay before we get the response .

First let’s inject the name parameter then move to the email ….

When injecting the name field , we don’t get any delays which means our command wasn’t executed .

Now moving on to the email field :

email=test@gmail.com||sleep+10||& .....

Make sure the space is URL encoded .

We get a delay this time of exactly 10 sec .

This confirms the Command Injection .

Now if we go back to the lab it should be solved since we triggered the 10 seconds delay .

That was all for this lab, see you in the next one :)