IoT Penetration Testing Cookbook

Exploiting command injection

In embedded systems, OS command injection is a vulnerability most commonly via a web interface or debug page left from development firmware builds in order to execute arbitrary operating system commands. The user supplies operating system commands within a web service parameter through a web interface in order to execute OS commands. A parameter that is dynamic and not properly sanitized is subject to this vulnerability being exploited. With the ability to execute OS commands, an attacker can upload malicious firmware, change configuration settings, gain persistent access to the device, obtain passwords, attacker other devices in a network, or even lock out legitimate users from the device. In this recipe, we ...