Objective
Execute arbitrary system commands on the server to read the contents of the hidden file: /etc/flag.txt.
Background
OS Command Injection occurs when an application passes unsafe user-supplied data to a system shell. In this lab, a network diagnostic tool allows users to ping an IP address.
The Code (Simulated)
The backend takes your input and directly concatenates it into a shell command:
target_ip = request.POST['ip']
// VULNERABILITY: No input sanitization!
result = system("ping -c 3 " + target_ip)
return result
How to Exploit
In Unix-like systems, you can chain commands together using separators like ; (semicolon), && (AND), or | (pipe).
If you provide an IP address followed by a separator and another command, the server will execute both.
Hint: Try entering an IP address like 127.0.0.1, then add a semicolon ; followed by the command to read a file (like cat /etc/flag.txt).