Command Injection – Shell Injection

Contents
Hack…………………………………………………………….………………………………………………………………3
Command Injection or Shell Injection………………………………………………………………………..4
Shellcode Deliverance Scenario – Reverse Shell and Bind Shell……………………………….6
Bind Shell – Binding a Shell with Installed Scripting Languages ……………………………….8
Reverse Shell – Establishing a Data Stream via TCP/IP Sockets………………………………10
Shell Injection v/s Remote Code Execution v/s Code Injection ………………………………22
Command Injection Vulnerable Code using PHP ‘system()’ Function ……………………..29
Exploiting Command Injection on PHP to Obtain Command Execution…………………..31
Obtaining a Shell via Arbitrary Command Execution on PHP Application…………..…..34
Mitigating Vulnerable PHP Code Using Safe Escape Functions…………………………………37
Secure Design PHP Code Implementation……………………………………….……………………..41
Command Injection Vulnerable Code Using WScript in Classic ASP………………………..43
Exploiting Command Injection on ASP to Obtain Command Execution ………………..48
Obtaining a Shell via Arbitrary Command Execution on ASP Application ……………..59
Post-Exploitation Using PowerShell via InvokeShell.ps1 ………………………..…………….67
Mitigating Vulnerable ASP Code Using Safe API Functions ……………………………………72
OS Command Injection Using Intended Vulnerable Application…………………………….74
Obtaining Shell via Telnet Service on Windows Platform…………………………………………82
Maintaining a Backdoor Access via Telnet using VSFTPD Set-up ……………………………94
Covert ASP Shell for ASP based Backdoor on IIS Web-Servers……………………………..103
Contact Information………………………………………………………………………………………………….108

Source