Commix Not Executed Properly When Run Programatically

[nik-ngp]

What's the problem (or question)?

Commix has issues when running under an emulated terminal.

For example, I tried running it within Python (which does execution differently, it creates an actual process) and it worked (edit it does not): import subprocess cmd = "commix -r req.txt --ignore-stdin --batch" returned_value = subprocess.call(cmd, shell=True) print(returned_value)

How can we reproduce the issue?

https://github.com/nik-ngp/commix-bug

When I run the program in the repo I receive this in the console:

What are the running context details?

• Installation method pacman
• Client OS Arch Linux, Garuda, x86_64
• Program version v4.0-dev#53

[stasinopoulos]

@nik-ngp honestly I don’t get the reason why to do that. Anyway, by knowing that in a Python environment works as it should, i am closing this down.

[nik-ngp]

@stasinopoulos

by knowing that in a Python environment works as it should, i am closing this down

The Python code actually doesn't work. My Python skills are a bit rusty and I have provided wrong code.

The code I provided does not return output of the executed command, the file descriptors were inherited from the running process which meant that the executed command was writing directly to standard out & err. Instead of to a variable.

Here is an updated script: import subprocess cmd = "commix -r req.txt --ignore-stdin --batch" # cmd = "echo 123" # <--- Works def do(command: str) -> str: try: return subprocess.check_output( command, shell = True ).decode('utf-8') except Exception as e: print(e) return 'Error' output = do(cmd) print(output)

This code reproduces the same behavior I am experiencing in the Golang example. If I set in my Golang code's stdout & stderr to os.Stdout & os.Stderr it would be equivalent to my initial Python example that worked.

honestly I don’t get the reason why to do that

I have a crawler that records requests with data and automatically targets them with Commix. Why would I have to crawl and run against endpoints when my script can? I am simply saving my own time.

[stasinopoulos]

@nik-ngp why not parsing targets (as a piped-in input) directly from your / other pentesting tools? (e.g https://x.com/commixproject/status/1525726750285733889)

[nik-ngp]

@stasinopoulos I did some attempts, however, it seems that it does not support piping in raw requests.

[stasinopoulos]

I updated your code and now works fine.

import subprocess

url = "http://php.testsparker.com/nslookup.php?param=1"
cmd = f"commix -u {url} --batch --os-cmd=whoami --answers=\"shell=n\""

def do(command: str) -> str:
  try:
    return subprocess.run(
      command,
      shell = True
    )
  except Exception as e:
    print(e)
    return 'Error'
output = do(cmd)
print(output)

[nik-ngp]

Hello @stasinopoulos. I have to admit, you got me a bit confused. I'm unsure of what the updated code is meant to represent since it deviates from the purpose of my script in two ways:

• It does not rely on raw request as an input.
• It does not actually write anything into a variable. The output that's displayed in the screenshot is because the file descriptors of the process point to the terminal itself, not to an in-memory buffer. This is provable by commenting out the call to the print function which would still output Commix to the terminal.

[stasinopoulos]

@nik-ngp just of curiosity, have you tried the same using other (similar) tools (e.g. sqlmap etc)? Anyway, I'll take a look into this issue and get back to you soon.

[nik-ngp]

@stasinopoulos Indeed I am using Sqlmap to tests against raw requests. It works nicely with my code.

[stasinopoulos]

Potential fix: https://github.com/commixproject/commix/commit/ebe84fac8a3f06db3590fd447434627d5ffef16e. Please check again.

[github-actions[bot]]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

_{This action has been performed automatically by a bot.}