Command Injection Chain Lab

Command Injection — Escaping Application Context into the Shell

What is OS command injection?

Many web applications need to invoke operating system commands as part of their functionality: running a network diagnostic tool, converting an image, compressing a file, sending an email via a CLI utility, or querying DNS. When the application builds the shell command string by concatenating user-supplied input without sanitization, an attacker can inject additional shell commands and have them executed by the server.

This vulnerability is classified as OS Command Injection and sits under OWASP A03:2021 — Injection, the same category as SQL injection. The root cause is identical: user data escaping its data context and being interpreted as code.

A vulnerable example

Consider a network administration page that pings a user-supplied hostname:

// Vulnerable PHP code
$host = $_GET['host'];
$output = shell_exec("ping -c 1 " . $host);
echo $output;

When a normal user enters 8.8.8.8, the server runs:

ping -c 1 8.8.8.8

But when an attacker enters 8.8.8.8; id, the server runs:

ping -c 1 8.8.8.8; id

The semicolon is a shell metacharacter that separates two commands. The shell runs ping first, then executes id — revealing the web server's process identity.

Shell metacharacters

The Unix shell interprets many characters as operators rather than literal text. Attackers exploit these to chain commands:

The escalation chain

Command injection vulnerabilities typically allow attackers to escalate their access step by step:

1. Confirm injection — use ; id or ; whoami to confirm the server executes your command and reveal the process user
2. Reconnaissance — ; ls /var/www/html to enumerate files, ; uname -a for kernel info
3. Sensitive data — ; cat /var/www/html/config.php to read database credentials and application secrets
4. Full RCE — writing a web shell, downloading a reverse shell, or exfiltrating data to an attacker-controlled server

Real-world impact

• Shellshock (CVE-2014-6271): A vulnerability in the Bash shell itself that allowed command injection via environment variables. Millions of servers were vulnerable; attacks began within hours of disclosure.
• Network equipment: Many home routers and enterprise devices expose ping/traceroute utilities that are vulnerable to command injection in their admin panels.
• CI/CD pipelines: Build systems that incorporate user-supplied branch names or commit messages into shell commands are frequently vulnerable.

What you will do in this lab

You will attack a simulated Admin Ping Utility — a web form that runs ping -c 1 <HOST> on the server. You will:

1. Confirm command injection by appending ; id to reveal the web server's user identity
2. Enumerate the server's web root to find a sensitive configuration file
3. Read the file to extract the CTF flag hidden inside it