In practice, almost all operating systems have some kind of command interpreter, a text-based interface. In Windows, it is called Command Prompt (cmd.exe) or PowerShell, in Linux and Mac it is bash, sh, zsh, etc. And these command interpreters can be used to start text-based programs and commands. For example, we can ping Google:

Sometimes applications utilize console tools in the background. We could have a web application, for example made with Python, whose purpose is to ping a specific IP address and display the ping result on the website. The code could look like this:

The problem here is that adding user input to an operating system command is extremely dangerous. By adding certain special characters to the "IP address", an attacker may trick the application into executing completely different operating system commands than ping.

Let's take command substitution, for example, which allows us to take the output of another command as part of a command. Substitution can be done with the syntax 

So by entering an IP address such as 1.2.3.4

we could get the following response: "Ping 1.2.3.4$(id) result: ping: 

: Name or service not known." This is the output of the id command (in this case the user was root).

There are countless ways to inject one's own commands in between or after if one is able to write within an operating system command. Some examples:

Labrassa is a web diagnostic tool that checks if a website is up. The tool uses the curl command in the background. From the top of the page, you can see which commands are executed on the server.

It is generally advisable to avoid executing operating system commands and strive to achieve the same result with code. If this is not a preferred option, it is important that:

1. Operating system commands are never constructed by concatenating text, like:

The commands should be built using a software library that securely ensures that the input does not spread beyond the specified parameter:

2. The parameter that comes from outside the program (such as user input, database, API, etc.) must be 

3. The parameter that the user of the application is allowed to influence, for example, must be properly 

. Let's take curl as an example. Is it enough to use a secure library to form the curl call and let the user only decide the URL address? Should we also validate that the URL is in the correct format?

Not enough! With Curl, you can read files from the server's disk.

What if you ensure that the URL addresses start with http:// or https://? Not enough! With cURL, one could call local or intranet HTTP interfaces on the server that were not meant to be open to the Internet.

The point is, that operating system commands often have capabilities that one wouldn't have thought of. If they have to be used, it is important to exercise caution.

Käyttöjärjestelmäkomentojen ajamista kannattaa lähtökohtaisesti välttää, ja pyrkiä saavuttamaan sama asia koodilla. Jos tämä ei ole mieluinen vaihtoehto, niin on tärkeää että: 

 rakenneta tekstiä yhdistelemällä, kuten: 

Komennot tulee rakentaa sellaisella ohjelmistokirjastolla, joka osaa turvallisesti huolehtia, ettei syöte leviä kyseisen parametrin ulkopuolelle: 

2. Parametri, joka tulee mistään ohjelman ulkopuolelta (kuten käyttäjän syötteestä, tietokannasta, rajapinnasta, jne), tulee 

3. Parametri, johon esimerkiksi sovelluksen käyttäjän annetaan vaikuttaa, tulee 

 kunnolla. Otetaan esimerkiksi curl. Riittääkö, että käytetään turvallista kirjastoa muodostamaan curl-kutsu, ja annetaan käyttäjän vain päättää URL-osoite? Jos vielä validoidaan että URL on oikeanmuotoinen?

Ei riitä! Curlilla voi lukea tiedostoja palvelimen levyltä.

Entäs jos varmistaa että URL-osoitteet alkavat http:// tai https://? Ei riitä! Curlilla voisi kutsua palvelimella olevia paikallisia tai sisäverkon HTTP-rajapintoja, joiden ei ollut tarkoitus olla auki Internetiin.

Pointti on, että käyttöjärjestelmäkomennoilla on usein sellaisia kyvykkyyksiä joita ei olisi tullut ajatelleeksi. Jos niitä on pakko käyttää, on syytä noudattaa varovaisuutta.

Protection against command injections

Komentoinjektioilta suojautuminen

Acquire root permissions on the server and read the file 

In this lab, you get to practice command injection attack against a vulnerable network diagnostic service.

Online diagnostics

## Operating System Commands

In practice, almost all operating systems have some kind of command interpreter, a text-based interface. In Windows, it is called Command Prompt (cmd.exe) or PowerShell, in Linux and Mac it is bash, sh, zsh, etc. And these command interpreters can be used to start text-based programs and commands. For example, we can ping Google:

```sh
$ ping google.com
PING google.com (209.85.233.101) 56(84) bytes of data.
64 bytes from lr-in-f101.1e100.net (209.85.233.101): icmp_seq=1 ttl=114 time=82.4 ms
```

---

## Operating System Commands in Programming

Sometimes applications utilize console tools in the background. We could have a web application, for example made with Python, whose purpose is to ping a specific IP address and display the ping result on the website. The code could look like this:

```python
def do_GET(request):
    ip = request.get_parameter("ip")
    result = os.popen(f"ping -c1 {ip}").read()
    return {"result": result}
```

---

## Injection

The problem here is that adding user input to an operating system command is extremely dangerous. By adding certain special characters to the "IP address", an attacker may trick the application into executing completely different operating system commands than ping.

---

## Command Substitution

Let's take command substitution, for example, which allows us to take the output of another command as part of a command. Substitution can be done with the syntax **$(command)** or **\`command\`**.

```sh
$ pwd
/ etc
$ echo "pwd is: $(pwd)"
pwd is: /tmp
$ echo "pwd is: `pwd`"
pwd is: /tmp
```

So by entering an IP address such as 1.2.3.4**$(id) **we could get the following response: "Ping 1.2.3.4$(id) result: ping: **uid=0(root) gid=0(root) groups=0(root)**: Name or service not known." This is the output of the id command (in this case the user was root).

---

## Imagination is the limit

There are countless ways to inject one's own commands in between or after if one is able to write within an operating system command. Some examples:

```sh
# Semicolon, starts a new command.
echo abc; id

# One pipe, takes the output of the previous command and redirects it to the new command
echo abc | id;

# Two ampersands, start a new command if the previous command succeeds.
echo abc && id;
```

---

## Exercise

Labrassa is a web diagnostic tool that checks if a website is up. The tool uses the curl command in the background. From the top of the page, you can see which commands are executed on the server.

![](sanity:image-5a5f288e12b6a5290a7e78d0d2e5731adc50e330-785x462-png)

Try to read the file **/flag.txt**.

@embed 4d02fbd13836

@exercise 6f05e094455e


Käyttöjärjestelmäkomentojen ajamista kannattaa lähtökohtaisesti välttää, ja pyrkiä saavuttamaan sama asia koodilla. Jos tämä ei ole mieluinen vaihtoehto, niin on tärkeää että: 

1. Käyttöjärjestelmäkomentoja ei **koskaan** rakenneta tekstiä yhdistelemällä, kuten: 

```python
os.system("ping " + ip)
```

Komennot tulee rakentaa sellaisella ohjelmistokirjastolla, joka osaa turvallisesti huolehtia, ettei syöte leviä kyseisen parametrin ulkopuolelle: 

```python
subprocess.Popen(['ping', ip])
```

2. Parametri, joka tulee mistään ohjelman ulkopuolelta (kuten käyttäjän syötteestä, tietokannasta, rajapinnasta, jne), tulee **validoida** mahdollisimman tarkasti.

3. Parametri, johon esimerkiksi sovelluksen käyttäjän annetaan vaikuttaa, tulee **ymmärtää** kunnolla. Otetaan esimerkiksi curl. Riittääkö, että käytetään turvallista kirjastoa muodostamaan curl-kutsu, ja annetaan käyttäjän vain päättää URL-osoite? Jos vielä validoidaan että URL on oikeanmuotoinen?

Ei riitä! Curlilla voi lukea tiedostoja palvelimen levyltä.

```sh
$ curl file:///etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
```

Entäs jos varmistaa että URL-osoitteet alkavat http:// tai https://? Ei riitä! Curlilla voisi kutsua palvelimella olevia paikallisia tai sisäverkon HTTP-rajapintoja, joiden ei ollut tarkoitus olla auki Internetiin.

Pointti on, että käyttöjärjestelmäkomennoilla on usein sellaisia kyvykkyyksiä joita ei olisi tullut ajatelleeksi. Jos niitä on pakko käyttää, on syytä noudattaa varovaisuutta.

What are command injections?

One of the scariest places an injection vulnerability can hit is operating system commands. The penalty is almost always a complete takeover of the server by the attacker. However, these vulnerabilities are found quite often when the application uses, for example, command line tools behind the scenes.

One of the scariest places where an injection vulnerability can hit is operating system commands. The consequence is almost always the complete takeover of the server by the attacker. However, these vulnerabilities are quite often found when an application uses command-line tools behind the scenes.

What are command injections?

Operating System Commands

Learn to hack — start here