PortSwiggerlabs: Blind OS command injection with output redirection

Scenario :

This lab contains a blind OS command injection vulnerability in the feedback function.

The application executes a shell command containing the user-supplied details. The output from the command is not returned in the response. However, you can use output redirection to capture the output from the command. There is a writable folder at:

/var/www/images/ The application serves the images for the product catalog from this location. You can redirect the output from the injected command to a file in this folder, and then use the image loading URL to retrieve the contents of the file.

To solve the lab, execute the whoami command and retrieve the output.

Solution :

First we browse the app just like a normal user , then we check Burp’s History for interesting Requests .

We’re mainly looking for parameters where we can inject , whether in a POST or GET request (Mainly POST since that’s what we’re sending to the server ) .

Since this is a Command injection , what we’re hoping for is that the parameter being passed to the server gets placed inside a system command (or passed to a function that executes shell commands), so the server ends up running our input as part of a command.

So to abuse this we can add a command injection payload to make it so that it executes an additional command .

there are plenty of command injection payloads that we can use .

We will use something that works for both Linux and Windows :

||

Just like the lab before, we find this endpoint , where we can submit our feed back .

Checking Burp, we see that this is indeed a POST Request with multiple parameters that we can inject .

I first injected the name but didn’t work .

No way for us to know , we’ll use the time delay technique to find the vulnerable parameter first .

||sleep+10||

Didn’t get any delay which means it wasn’t executed , let’s move to the email field .

And we got our delay which confirms the email is indeed the vulnerable field .

Now to get the output of this command we’re given a writable file that we can use .

/var/www/images/

All we have to do is pipe the output of the command into that file , and from there read the file content by modifying the filename parameter .

||whoami>/var/www/images/output.txt||

Now let’s try reading the content of the output.txt file we just created .

We just modify the filename to the specific file we wrote into .

This didn’t work , but remembering the labs from Path traversal , there was a case where we had to specify the file name only, since it will append /var/www/images/ by default.

Perfect we get the output of the whoami command .

This should solve the lab .

That was all for this lab , see you in the next one :)

That was all for this lab, see you in the next one .