# OS command injection, simple case

## Lab Description

This lab contains an OS command injection vulnerability in the product stock checker.

The application executes a shell command containing user-supplied product and store IDs, and returns the raw output from the command in its response.

To solve the lab, execute the <mark style="color:red;">**`whoami`**</mark> command to determine the name of the current user.

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2FxPW9jjcCfFubX5j2hfEl%2Fimage.png?alt=media&#x26;token=adb5c980-0664-48f0-923e-4b92aa011d5d" alt=""><figcaption></figcaption></figure>

## Walkthrough

### Step 1: Analyzing the Request

The first step is to identify how the application processes the input parameters. Using Burp Suite, intercept the request sent when checking the stock of a product. Here's the intercepted request:

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2Fn8v0cRfpNOdtjQE87r8L%2Fimage.png?alt=media&#x26;token=407ba407-57a2-4583-9c48-24f366f0fe53" alt=""><figcaption></figcaption></figure>

The request contains two parameters:

* `productId`
* `storeId`

The response returns a numeric value in plain text. At this point, we suspect the parameters are being used as part of a system command. Let’s test for command injection by sending the request to Burp Suite’s **Repeater** tool.

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2FEQAQZPJqsXQxZhFgukPI%2Fimage.png?alt=media&#x26;token=931c5051-8733-41e4-92d2-20d4bbdb4b14" alt=""><figcaption></figcaption></figure>

### Step 2: Identifying the Vulnerable Parameter

To confirm command injection, try appending a test command (like `;id`) to each parameter. Test both `productId` and `storeId` to determine:

1. Whether they are vulnerable to injection.
2. The order in which the parameters are executed.

#### After testing:

* **Both parameters** (`productId` and `storeId`) are injectable.
* The commands are executed in sequence: `productId` first, followed by `storeId`.

### Step 3: Exploiting the Vulnerability

Now that we know the parameters are injectable, we can craft a payload to execute the `whoami` command and identify the current user. Append the `;whoami` command to the `storeId` parameter:

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2FuRm1XYw7x1MD5Fb5Ort3%2Fimage.png?alt=media&#x26;token=ccb62500-bc08-4c6e-b3f0-e0eaa8026fdf" alt=""><figcaption></figcaption></figure>
