LAB 3 - Blind OS command injection with output redirection

Initial instructions

This lab contains a blind OS command injection vulnerability in the feedback function.

The application executes a shell command containing the user-supplied details. The output from the command is not returned in the response. However, you can use output redirection to capture the output from the command. There is a writable folder at: /var/www/images/

The application serves the images for the product catalog from this location. You can redirect the output from the injected command to a file in this folder, and then use the image loading URL to retrieve the contents of the file.

To solve the lab, execute the whoami command and retrieve the output.

To come across with this lab first of all we need to intercept this feedback via BurpSuite.

Once intercepted I tried this payload in email parameter.

email=test%40test.com||whoami+>+/var/www/images/output.txt||

Once this It worked but we need to figure out where is this output.txt, searching a little bit I entered to some product and opened a image in another tab. And in the filename I put output.txt

https://0a81008f0369072a81081b5f006e0070.web-security-academy.net/image?filename=output.txt

And we get the command whoami with output redirection.

Congratulations, you solved the lab!