We start off our journey with command injection by studying the good side of
things, where we can
take a single command and have another command follow after it, and you may be
wondering how
do we do that? Well, that's where we come up with logical operators. Now,
logical operators
can very much have a skill all on its own, and we may do that at some point,
but we're only going
to be addressing one, and that is AND. And it's represented inside the terminal
in our POSIX-based
operating systems with an ampersand or a double ampersand. The reason that we
do this is because
we can trigger a command to start our process off, and based on either being
one ampersand or two
ampersands, we'll trigger a second command hidden inside of that process ID
that initiates
everything. So you may have seen in the past in our previous pin 103 and also
through this course
that we run, pseudo-apt update. And then we have two ampersands right in the
middle followed by
pseudo-apt upgrade. Well, this is a command that starts everything off with
pseudo-apt update.
The double ampersand tells us that whether this first one passes or fails, that
we're going to be
following up with another command of pseudo-apt upgrade. So we are command
injecting upgrade into
update. Now, if we use the single ampersand on this, it's going to tell us we
can run the second
command if the first one succeeds. If the first one fails, then we're just
going to stop right there.
And we use commands like this and command injection operations like this to
allow us to be able to
simplify administrative tasks or run a series of scripts that requires to be
able to invoke
different commands to the actual operating systems. And even inside of Windows,
run multiple commands
in sequence or in a certain conditional order. So that way we can ease our task
to do list
and make things a little bit easier on us. Now, inside of our Kali box inside
of our lab,
we're just simply going to frankly go to open terminal because we're just
running one single
command and that is pseudo-apt update. After we type in our Kali password for
pseudo, and this
is key right here too, because when we start doing command injection for those
pipe commands
with our logical operator, the ampersands, it's only going to ask for this
password once for both
of those commands. If we let this sit and let's say we go grab a cup of coffee
like I may or may
not do in between takes on this, it could be that our pass our pseudo session
has expired and we have
to come in and type the password again or this sits for a little bit. And we
waste a viable time
where we could be doing something else. Next part of our command when we want
to update a system is
pseudo-apt upgrade. And when we run this, we can see that we have a couple
options in here as well.
So we can go ahead and press enter on this because the default is yes, and you
could see that both
of those commands are running seamlessly because we have connection, we have
all of our credentials
verified and we ran the commands individually. But now I could very well hit
control C on this
and a wheel and we've stopped and we could now go in and say pseudo-apt.
Did I type that right? I did not. pseudo-apt update, amper-amper, pseudo-apt
upgrade.
And I will zoom in for you real quick to show you what that looks like. That's
both of our
commands right there with the logical operator of and inside of there. Now I'm
using the amper-amper
for a couple of reasons. One, I want this to run one right after the other. It
may not verify our
confirmation, but it will run commands in sequential order, regardless of the
status of the first one.
So if you want to make sure that upgrade runs after did a proper update, you
might want to use a
single amper sand. So let's go ahead and run this and we could see that it
skipped straight through.
I'm going to scroll up and then zoom in for you real quick. It went straight.
Oh, I ran it
upgrade twice, my bad. Also helps if you are good on your typing skills. Date,
there we go.
You can see it's running through the update right now and then immediately jump
to the
upgrade, which is what we intended to do. And I totally didn't stuff the
keyboard.
But now we're going to hit enter and continue on. Now while this runs, we have
an easy way now to
be able to run update and upgrade with a simplistic logical operator being our
filler for the command
injection. And now just like that, we all know the basis of steps required to
be able to do command
injection and we've seen the good side of it.