# OS command injection, simple case

## Description

This lab contains an OS command injection vulnerability in the product stock checker.

The application executes a shell command containing user-supplied product and store IDs, and returns the raw output from the command in its response.

To solve the lab, execute the `whoami` command to determine the name of the current user.

## Solution

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FIYINfVmSJ7YTJn6NVq75%2Fimage.png?alt=media&#x26;token=0a46e6d2-1da4-4e96-be2a-af11ec186b64" alt=""><figcaption></figcaption></figure>

Every product has a dedicate check function to retrieve if a product is availble or not:

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Fw4VKbXq5CDkSl3KWyTxd%2Fimage.png?alt=media&#x26;token=778694ad-a3dd-4717-8afb-5d8c72188efc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Fj4hcMvPq4vjU2mkqd6iu%2Fimage.png?alt=media&#x26;token=3c4e26fc-6f9d-4400-9506-bcfe929020dc" alt=""><figcaption></figcaption></figure>

We can try to concatenate it with a payload like as ; & or |: `;whoami`

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Frnsor0zyITIngg3mBUqM%2Fimage.png?alt=media&#x26;token=2b89f0cb-bcb5-40da-bad0-66ba75f59629" alt=""><figcaption></figcaption></figure>

and we obtain the user of system: peter-Gu9oqX solving the lab.

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FUZKZh3cKn0j6HjUGyZxX%2Fimage.png?alt=media&#x26;token=ef6de5e9-036d-4c13-8be8-46a1f6d779d2" alt=""><figcaption></figcaption></figure>
