Blind OS Command Injection with time delays from Theory to Practical POC

👋 Hola Hackers, I’m Dhruv Singh, a cybersecurity enthusiast passionate about exploring the depths of ethical hacking. Today, we’ll delve into an intriguing vulnerability: Blind OS Command Injection with time delays. This blog is more than just a technical deep dive; it’s a celebration of discovery and learning in the cybersecurity realm. Let’s get started! 🕵️‍♂️💻

In the world of cybersecurity, finding vulnerabilities is crucial for protecting systems and data. One such vulnerability is the Blind OS Command Injection, which allows attackers to execute arbitrary commands on the host operating system. This blog will walk you through an actual instance of Blind OS Command Injection with a time delay, detailing how it was discovered, tested, and confirmed through a Proof of Concept (POC).

OS Command Injection is a type of vulnerability where an attacker can execute arbitrary commands on a host operating system through a vulnerable application. The “blind” aspect refers to scenarios where the attacker cannot see the immediate output of the commands, making it more challenging but not impossible to confirm the vulnerability.

Source :- https://portswigger.net/web-security/os-command-injection

The Bug: Blind OS Command Injection with Time Delay

In a recent penetration test, I discovered a Blind OS Command Injection vulnerability in an application. The application took user input and passed it to the system’s command line without proper sanitization. Here’s a step-by-step account of how I identified and exploited this vulnerability.

I used a simple but effective payload to test for the vulnerability:

|ping -n 11 127.0.0.1||ping -c 11 127.0.0.1ping -n 11 127.0.0.1 is for Windows-based servers. The -n flag specifies the number of echo requests to send.ping -c 11 127.0.0.1 is for Linux-based servers. The -c flag specifies the number of packets to send.

Combining |ping -n 11 127.0.0.1||ping -c 11 127.0.0.1 in the payload serves a practical purpose during the testing of Blind OS Command Injection. The primary reason for using both variations together is to ensure the payload is effective regardless of the underlying operating system, which may be unknown or uncertain at the time of testing.

🔍 Why Use Ping?

Ping is a command-line utility used to test the reachability of a host on an IP network. By introducing a delay, it allows us to observe the time taken for the response, which can confirm if our injected command is being executed.

In the screenshots below, you’ll notice that certain details, such as host addresses and sensitive data, have been obfuscated. This is done to maintain security and confidentiality while still allowing us to explore the technical aspects of Blind OS Command Injection with time delays.

Identifying the Vulnerability

During my penetration testing, I came across a web service that processed user requests containing sensitive personal information. Here’s a typical structure of the request:

<request>
<a_name>John Doe</a_name>
<a_MobileNumber>1234567890</a_MobileNumber>
<a_EMAILID>johndoe@example.com</a_EMAILID>
<a_AdhaarNumber>1234567890123</a_AdhaarNumber>
<a_Country>India</a_Country>
</request>

Upon examining the code and response behaviors, I noticed that the <a_AdhaarNumber></a_AdhaarNumber> field in the request was not properly sanitized. This lack of sanitization opened up a potential vector for Blind OS Command Injection, a critical vulnerability that allows an attacker to execute arbitrary commands on the server.

Initial Analysis:

I began by sending regular data through the web service to monitor the responses.

The initial responses were typical, with no noticeable delays or errors, indicating that the system was processing the requests normally.

2. Testing for Injection Points:

I tested for potential injection points by sending various payloads within the <a_AdhaarNumber></a_AdhaarNumber> field to observe how the server responded.

For instance, I used the following payload:

<request>
<a_name>John Doe</a_name>
<a_MobileNumber>1234567890</a_MobileNumber>
<a_EMAILID>johndoe@example.com</a_EMAILID>
<a_AdhaarNumber>|ping -n 11 127.0.0.1||ping -c 11 127.0.0.1</a_AdhaarNumber>
<a_Country>India</a_Country>
</request>

3. Observing Indirect Indicators:

After injecting the payload, I carefully monitored the server’s response time.Although I didn’t receive any direct output or error messages, I observed a noticeable delay of approximately 11 seconds, which is consistent with the execution of the ping command.This delay suggested that the command was being executed on the server, confirming the vulnerability.

4. Confirming the Blind Injection:

The observed delay provided indirect evidence that the <a_AdhaarNumber></a_AdhaarNumber> field was susceptible to Blind OS Command Injection. The server executed the commands, leading to the time delay.

Normal Response:

Response Time of 56 millis

Delayed Response:

Response Time of 11,876 millis

Exploitation Potential

With this vulnerability, an attacker could execute more harmful commands, such as retrieving sensitive data, manipulating files, or even gaining remote control of the server. It’s crucial to address such vulnerabilities promptly to prevent potential exploitation.

Remediation

To protect against OS Command Injection vulnerabilities, consider the following best practices:

Input Validation: Ensure all user inputs are properly validated and sanitized. Use whitelisting where possible to restrict input to safe characters.Use Parameterized Commands: Avoid constructing shell commands with user input. Use parameterized commands or system APIs that don’t require invoking the shell.Least Privilege: Run applications with the least amount of privileges necessary. This limits the impact of an attack if an injection vulnerability is exploited.Regular Security Audits: Conduct regular security assessments to identify and mitigate vulnerabilities.

Conclusion

Blind OS Command Injection vulnerabilities are serious and can lead to significant security breaches. In this case, I identified and confirmed the vulnerability using a simple time delay method as part of my POC. By following best practices and staying vigilant, you can protect your applications and data from such threats.

If you found this blog helpful, please share it with your network and stay tuned for more insights into cybersecurity!

If you have any queries or would like to discuss further, you can connect with me through LinkedIn.

TILL THEN HAPPY HACKING! 🛡️🔐