OS Command Injection; The Pain, The Gain

A practitioner blog post recounts finding an OS command injection in an Apache/Red Hat web application discovered via Burp Suite. The author describes troubleshooting a 32-character command-length constraint, realizing that output resembling HTTP headers could be injected into response headers to exfiltrate /etc/passwd, discovering Python on the target, fetching a Python Meterpreter payload with wget, and obtaining a reverse shell (with post-exploitation pty upgrade).