►
From YouTube: Mehmet INCE - Best way to RCE: command injection
Description
Mehmet INCE is a Managing Partner of INVICTUS. He regularly shares his ideas about current security issues and offers his contributions to the global security community on his blog. In this talk, he takes us through several command injection issues that he has discovered.
Get involved with the GitHub Security Lab here: https://securitylab.github.com/get-involved
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
Google+: http://google.com/+github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
Hello
good
evening
to
everyone:
let's
talk
about
the
command
injection,
which
is
my
one
of
the
favorite
vulnerability
type.
This
is
mehmet
tingje,
I'm
working
for
the
invictus
cyber
security
and
the
intelligence
company
and
I've
been
doing
one-level
research
for
many
many
years
and
mdi
sec
is
my.
You
know
twitter
handler
and
the
pentastar
plug
is
a
web
page
me
and
my
teammates
sharing
our
you
know:
research
with
the
community
all
over
the
world.
A
A
So
successful
exploitation
of
the
command
injection
usually
so
dangerous
because
you
are
just
taking
a
control
of
two
operating
system
so
that
you
can
go
to
the
post
exploitation
phase
like
accessing
a
different
service
on
the
same
zone
or
exfiltrated
data,
etc,
etc.
So
the
question
is:
why
does
an
application
needs
to
execute
operating
system
comment
in
the
first
place,
because
we
are
not
doing
something
out
of
the
blue.
We
are
just
abusing
some
features
in
the
software,
so
it
I
believe
it's
so
important
to
understand.
A
Why
does
the
application
needs
to
execute
operating
system
commands
and
the
answer?
You
know
the
reasons
I
have
seen
on
my
life.
I
have
a
couple
of
reasons
in
here.
By
the
way
I've
been
doing
a
lot
of
wonderful
research
on
the
security
solutions,
so
we
have
a
lots
of
example,
and
also
I
have
a
case
study
today
for
you
to
talk
about
anyways.
A
A
They
are
just
executing
a
powershell
script
that
has
been
written
by
the
developers,
so
the
username
and
the
password
or
the
domain
name
or
the
path.
You
know
those
parameters
are
taken
from
the
user,
so
basically
we
can
do
the
command
injection
and
another
thing
that
I've
seen.
Actually
the
backup
feature
every
single
product
that
I've
seen
on
my
life
has
a
feature
and
whenever
you
are
dealing
with
backup,
that
means
you
need
to
take
all
the
configuration
from
from
the
file
system.
You
need
to
dump
the
database.
A
You
know
you
need
to
collect
all
the
information
and
you
need
to
compress
them
and
give
it
back
to
the
user
as
a
zip
file
and
easiest
way
to
do
it.
Writing
a
custom,
bash
script
on
the
server
side
and
whenever
you
click
to
you
know
the
back
up
the
backup,
the
system
that
basically
going
to
be
executed
and
if
you
manage
to
control
part
of
that
command,
you're
going
to
have
the
command
injection.
A
So,
there's
a
lots
of
lots
of
different
cases
that
I've
seen,
but
those
are
the
most
interesting
that
I've
seen
in
the
past
couple
of
years.
As
I
said
you
before,
I
have
a
case
study
for
you
and
which
is
the
trunk
macro
interesting
web
security,
virtual
appliance.
So
I
was
doing
vulnerable
to
research
on
that
product
and
I'm
going
to
talk
about
what
I've
seen
before
diving
into
the
details.
A
Once
you
have
all
the
jar
files
you
can
just
compile
them
and
by
using
ides
you
can
load
those
the
compiled
files
into
the
project
structure
so
that
you
can
use
one
of
the
best
feature
of
the
ids,
which
is
defining
a
function
and
just
by
clicking
on
that
function.
Definition
you
can
see
all
the
different
places
that
function
has
been
called,
or
vice
versa.
Whenever
you
see
a
function,
you
just
click
on
it
and
go
to
the
definition.
A
That
capabilities
sounds
like
you
know
easy,
but
it
is
very,
very
important,
especially
if
you
are
doing
a
manual
quad
review
like
I
do
when
you
finish
those
job
you
can,
you
know,
follow
the
two
different
approach
so
top
to
bottom
or
bottom,
the
top
tap
the
bottom.
It's
just
like
you
know
starting
start
reading
the
source
code
by
the
filters,
and
then
you
can
go
to
the
controllers
and
service
and
repositories
model.
A
You
know
try
to
understand,
what's
happening
in
the
you
know
in
general,
but
if
you
don't
have
enough
time,
you
know
when
I
don't
have
enough
time.
Actually,
I'm
just
looking
for
the
potential
vulnerable
function
and
in
that
presentation
we
are
talking
about
operating
system,
command,
executions
and
every
single
programming.
Language
has
a
support
for
that
phone.
Like
a
shout
out
exactly
in
the
php,
like
you
know,
system
in
the
python
you
know
get
runtime
dot,
exec,
individual,
etc,
etc.
So
those
are
the
potential
function,
vulnerabilities
for
the
command
injection.
A
A
After
that,
you
can
try
to
find
out
whether
you
can
reach
out
that
part
of
the
software
and
also
it
is
important
to
find
out
what
kind
of
variables
you
can
take,
control
of
so
bottom,
the
top
or
top
to
bottom.
Let's
go
back
to
do
our
case
study.
So
while
I
was
reading
the
source
code,
I
have
seen
that
endpoint,
which
performs
a
validation
on
the
ip
address.
If
the
request
is
not
coming
from
the
locals,
it
performs
validation.
A
That
is
important
because
there
will
be
an
interesting
function,
call
at
the
rest
of
the
function,
but
whenever
you
find
the
command
injection,
you
can
come
back
in
here
and
try
to
find
out
to
bypass
those
validation,
and
you
know
checks.
So,
let's
keep
reading,
because
in
the
end
we
are
going
to
bypass
that
restriction.
A
As
you
can
see,
it
escapes
the
double
quotes
and
the
dollar
signs,
because
it
is
one
of
my
favorite
attack
vector
for
the
command
injection,
especially
when
the
application
performs
sitting
string
concretion
with
a
double
cost,
because
whenever
you
see
whenever
you
use
the
dollar
sign,
that
means
you
are
going
to
execute
a
different
command,
which
is
important
for
the
exploitation
phase.
Backtick
and
all
of
those
characters
has
been
escaped
with
a
backslash
and
backslash
has
been
escaped
again
in
here.
So
we
have
a
double
escaping
problem.
A
Maybe
after
that
is
well,
multi-wise
function
has
been
called
with
the
after
param,
which
is
the
only
object
that
we
can
control
in
here.
As
you
can
see
the
after
param.
It's
goes
to
the
israel
with
multi-wise,
which
means
we
need
to
read
that
function.
But
most
importantly,
we
are
seeing
exa
helper
cmd,
which
is
going
to
use
the
after
param
variable
that
we
can
control
what's
happening
in
these
valve
month
devices.
There
is
a
very
weak
blacklisting,
you
know,
and
it's
trimming
some
white
spaces,
etc,
etc.
A
So
bash
beam,
bash
python,
pearl,
titan
and
pearl,
starting
with
a
space.
You
know
we
can.
We
can
bypass
that
blacklisting
during
the
exploitation,
so
exus
helpful
cmd
calls
ui
helper,
which
is
as
which
has
a
suicide
with
a
root
user.
That
means
that
that
command
gonna
be
executed
with
the
root
user
and
finally,
exit
cmd.
A
It
executes
runtime
get
runtime
exec,
which
is
my
favorite
favorite
function
in
the
java
world.
So
in
order
to
prove
to
vulnerability,
which
is
called
the
slip
function
with
that
trick
and
as
you
can
see,
the
sleeper
can
be
executed
in
here
with
a
root
user.
So
basically
we
have
the
command
injection
vulnerability
when
the
topics
come
to
the
exploitation
you
know.
A
As
you
can
see
in
here,
we
have
the
double
quote
in
our
python
payload,
but
double
quote
can
be
used,
can't
be
used
because
it's
been
escaped
in
the
server
side.
In
order
to
overcome
that
problem,
I
just
switch
back
to
the
pearl,
but
I
still
want
to
execute
my
python
dropper,
so
I'm
just
implanting
my
python
dropper
into
the
pearl,
because
it's
not
going
to
use
the
double
quotes.
It's
going
to
use
the
single
code,
so
we
are
going
to
execute
perl,
which
is
our
go,
which
is
going
to
be
our
first
dropper.
A
It's
going
to
be
executed,
our
python,
which,
which
is
going
to
be
our
second
stage
of
the
exploitation
and
the
python
gonna,
go
to
the
communication
with
a
c2
server.
I'm
gonna
take
the
rest
of
the
payload.
So
when
the
topics
come
to
the
exploitation
of
command
injection,
your
you
know
your
imagination
becomes
and,
of
course,
linux.
A
Our
windows
operating
system-
knowledge
becomes
very
important
so,
as
I
said
before,
that
that
vulnerability
has
been
sold,
but
as
you
can
see
in
the
vulnerability
details,
authentication
is
required
to
exploit
that
vulnerability,
but
whenever
I
find
a
authenticated
command
injection,
I
just
go
back
to
the
initial
phase
to
find
out
way
to
bypass
the
authentication.
So,
let's
let
me
play
the
video.
A
I
have
implemented
the
meta
split
module
that
one
and,
as
you
can
see
in
here,
I
find
a
way
to
leak
to
active
session
id
and
by
using
the
session
id,
we
are
going
to
do
a
month
device
endpoint
where
we
have
the
command
injection
model.
So
we
have
some
sort
of
combination
of
the
three
different
vulnerabilities,
two
of
them
used
to
bypass
the
authentication
and
the
third
one
is
the
current
injection
right.
So,
as
you
can
understand,
it's
all
about
input.
Actually,
this
is
not
spatial
for
the
command
injection.
A
Like
you
know,
sql
injection,
it
is
like
a
you
know.
The
way
you
are
controlling
some
part
of
the
sql
query
and
you
are
just
doing
the
manipulation
here.
So
it's
same
for
the
command
injection
as
well.
That
means
the
input
means
literally
everything,
but
you
know
for
the
command
injection
it
doesn't
have
to
be.
You
know
the
command
injection
it
doesn't
has
to
be
between
the
request
and
the
response
cycle.
A
It
can
be
outside
of
that
request
and
response
cycle,
and
I'm
gonna
draw
the
case
that
I'm
thinking
in
here
start
drawing.
There
is
a,
let
me
let
me
login
with
the
go,
but
I'm
gonna
update
the
date
on
this
server
side.
Maybe
I
don't
need
to
log
in
maybe
the
applications
I
just
logged
in
because
of
that
session,
update
on
the
server
side,
so
anyways
we
have
the
application
in
here
and
that's
the
application
boundaries.
You
know
that's
the
application
we
have.
A
So
whenever
we
are
thinking
about
the
input
we
are
just
thinking
about
the
request
and
the
I'm
gonna
use
p
for
the
response,
request
and
response,
and
basically
we
have
http
in
here,
but
as
a
term
I
mean
the
input
means
every
single
data.
That's
come
into
the
application,
so
that
means
for
me
the
data
taken
from
the
databases.
A
It's
also
inputs
for
also
now
web
services
or
microservices.
The
data
that
you
are
taking
from
outside
of
your
application
means
input.
This
can
be
like
you
know
red
is,
it
can
be
the
file
you
are
reading
from
the
operating
system
file
system.
You
know
every
single
those
kind
of
data
that
comes
into
the
application
means
input
for
me.
So
when
the
topics
comes
to
the
input,
validation
or
the
security
from
the
developer
perspective,
they
are
doing
great
job
in
here.
A
But
I
don't
see
you
know,
input
validation
on
the
data
taken
from
the
database
or
the
data
taken
from
the
web
services.
So,
but
for
me
you
know,
input
means
literally
every
single
data.
That's
come
in
the
applications
inside,
so
I
have
one
interesting
case
for
that
scenario:
on
microfocus
email,
security,
appliance,
it's
been
like
a
couple
of
years,
but
the
software
takes
the
data
from
the
database.
As
you
can
see
in
here
the
first
column,
gonna
be
the
domain
and
the
second
column
gonna
be
the
selector
and
and
then
it
performs
some.
A
So
basically,
we
are
just
triggering
insert
queries
which
contains
our
payload
and
the
data,
our
payload
written
to
the
database,
and
it
has
been
taken
by
the
difference
part
of
the
application
and
that
part
is
going
to
execute
the
system
command
with
the
data
that
we
can
control
and
in
the
end,
as
you
can
see,
we
have
the
command
injection
so
guys.
Thank
you
very
much
for
listening
up
and
thank
you
very
much
for
the
github
security
team.
A
For
having
me,
I
just
want
to
talk
about
my
own
experience
for
the
zero
day
hunting
and
especially
for
the
command
injection
case.
It
is
especially
quite
popular
for
the
appliance
solutions
and
different
perspective
can
help
you
out.
Maybe
you
know
eventually,
I
hope
so
to
find
out
those
kind
of
vulnerabilities
and
thank
you
very
much.