first commit
This commit is contained in:
OPSXCQ
parent
985a5c928c
commit
f40a84879c
551 changed files with 72374 additions and 24 deletions
62
dvwa/vulnerabilities/exec/help/help.php
Normal file
62
dvwa/vulnerabilities/exec/help/help.php
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
<div class="body_padded">
|
||||
<h1>Help - Command Injection</h1>
|
||||
|
||||
<div id="code">
|
||||
<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
|
||||
<tr>
|
||||
<td><div id="code">
|
||||
<h3>About</h3>
|
||||
<p>The purpose of the command injection attack is to inject and execute commands specified by the attacker in the vulnerable application.
|
||||
In situation like this, the application, which executes unwanted system commands, is like a pseudo system shell, and the attacker may use it
|
||||
as any authorized system user. However, commands are executed with the same privileges and environment as the web service has.</p>
|
||||
|
||||
<p>Command injection attacks are possible in most cases because of lack of correct input data validation, which can be manipulated by the attacker
|
||||
(forms, cookies, HTTP headers etc.).</p>
|
||||
|
||||
<p>The syntax and commands may differ between the Operating Systems (OS), such as Linux and Windows, depending on their desired actions.</p>
|
||||
|
||||
<p>This attack may also be called "Remote Command Execution (RCE)".</p>
|
||||
|
||||
<br /><hr /><br />
|
||||
|
||||
<h3>Objective</h3>
|
||||
<p>Remotely, find out the user of the web service on the OS, as well as the machines hostname via RCE.</p>
|
||||
|
||||
<br /><hr /><br />
|
||||
|
||||
<h3>Low Level</h3>
|
||||
<p>This allows for direct input into one of <u>many PHP functions</u> that will execute commands on the OS. It is possible to escape out of the designed command and
|
||||
executed unintentional actions.</p>
|
||||
<p>This can be done by adding on to the request, "once the command has executed successfully, run this command".
|
||||
<pre>Spoiler: <span class="spoiler">To add a command "&&"</span>. Example: <span class="spoiler">127.0.0.1 && dir</span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>Medium Level</h3>
|
||||
<p>The developer has read up on some of the issues with command injection, and placed in various pattern patching to filter the input. However, this isn't enough.</p>
|
||||
<p>Various other system syntaxes can be used to break out of the desired command.</p>
|
||||
<pre>Spoiler: <span class="spoiler">e.g. background the ping command</span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>High Level</h3>
|
||||
<p>In the high level, the developer goes back to the drawing board and puts in even more pattern to match. But even this isn't enough.</p>
|
||||
<p>The developer has either made a slight typo with the filters and believes a certain PHP command will save them from this mistake.</p>
|
||||
<pre>Spoiler: <span class="spoiler"><?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/function.trim.php', 'trim()' ); ?>
|
||||
removes all leading & trailing spaces, right?</span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>Impossible Level</h3>
|
||||
<p>In the impossible level, the challenge has been re-written, only to allow a very stricted input. If this doesn't match and doesn't produce a certain result,
|
||||
it will not be allowed to execute. Rather than "black listing" filtering (allowing any input and removing unwanted), this uses "white listing" (only allow certain values).</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</div>
|
||||
|
||||
<br />
|
||||
|
||||
<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Command_Injection' ); ?></p>
|
||||
</div>
|
||||
67
dvwa/vulnerabilities/exec/index.php
Normal file
67
dvwa/vulnerabilities/exec/index.php
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
<?php
|
||||
|
||||
define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
|
||||
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
|
||||
|
||||
dvwaPageStartup( array( 'authenticated', 'phpids' ) );
|
||||
|
||||
$page = dvwaPageNewGrab();
|
||||
$page[ 'title' ] = 'Vulnerability: Command Injection' . $page[ 'title_separator' ].$page[ 'title' ];
|
||||
$page[ 'page_id' ] = 'exec';
|
||||
$page[ 'help_button' ] = 'exec';
|
||||
$page[ 'source_button' ] = 'exec';
|
||||
|
||||
dvwaDatabaseConnect();
|
||||
|
||||
$vulnerabilityFile = '';
|
||||
switch( $_COOKIE[ 'security' ] ) {
|
||||
case 'low':
|
||||
$vulnerabilityFile = 'low.php';
|
||||
break;
|
||||
case 'medium':
|
||||
$vulnerabilityFile = 'medium.php';
|
||||
break;
|
||||
case 'high':
|
||||
$vulnerabilityFile = 'high.php';
|
||||
break;
|
||||
default:
|
||||
$vulnerabilityFile = 'impossible.php';
|
||||
break;
|
||||
}
|
||||
|
||||
require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/exec/source/{$vulnerabilityFile}";
|
||||
|
||||
$page[ 'body' ] .= "
|
||||
<div class=\"body_padded\">
|
||||
<h1>Vulnerability: Command Injection</h1>
|
||||
|
||||
<div class=\"vulnerable_code_area\">
|
||||
<h2>Ping a device</h2>
|
||||
|
||||
<form name=\"ping\" action=\"#\" method=\"post\">
|
||||
<p>
|
||||
Enter an IP address:
|
||||
<input type=\"text\" name=\"ip\" size=\"30\">
|
||||
<input type=\"submit\" name=\"Submit\" value=\"Submit\">
|
||||
</p>\n";
|
||||
|
||||
if( $vulnerabilityFile == 'impossible.php' )
|
||||
$page[ 'body' ] .= " " . tokenField();
|
||||
|
||||
$page[ 'body' ] .= "
|
||||
</form>
|
||||
{$html}
|
||||
</div>
|
||||
|
||||
<h2>More Information</h2>
|
||||
<ul>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'http://www.scribd.com/doc/2530476/Php-Endangers-Remote-Code-Execution' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'http://www.ss64.com/bash/' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'http://www.ss64.com/nt/' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Command_Injection' ) . "</li>
|
||||
</ul>
|
||||
</div>\n";
|
||||
|
||||
dvwaHtmlEcho( $page );
|
||||
|
||||
?>
|
||||
37
dvwa/vulnerabilities/exec/source/high.php
Normal file
37
dvwa/vulnerabilities/exec/source/high.php
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'Submit' ] ) ) {
|
||||
// Get input
|
||||
$target = trim($_REQUEST[ 'ip' ]);
|
||||
|
||||
// Set blacklist
|
||||
$substitutions = array(
|
||||
'&' => '',
|
||||
';' => '',
|
||||
'| ' => '',
|
||||
'-' => '',
|
||||
'$' => '',
|
||||
'(' => '',
|
||||
')' => '',
|
||||
'`' => '',
|
||||
'||' => '',
|
||||
);
|
||||
|
||||
// Remove any of the charactars in the array (blacklist).
|
||||
$target = str_replace( array_keys( $substitutions ), $substitutions, $target );
|
||||
|
||||
// Determine OS and execute the ping command.
|
||||
if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
|
||||
// Windows
|
||||
$cmd = shell_exec( 'ping ' . $target );
|
||||
}
|
||||
else {
|
||||
// *nix
|
||||
$cmd = shell_exec( 'ping -c 4 ' . $target );
|
||||
}
|
||||
|
||||
// Feedback for the end user
|
||||
$html .= "<pre>{$cmd}</pre>";
|
||||
}
|
||||
|
||||
?>
|
||||
41
dvwa/vulnerabilities/exec/source/impossible.php
Normal file
41
dvwa/vulnerabilities/exec/source/impossible.php
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'Submit' ] ) ) {
|
||||
// Check Anti-CSRF token
|
||||
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
|
||||
|
||||
// Get input
|
||||
$target = $_REQUEST[ 'ip' ];
|
||||
$target = stripslashes( $target );
|
||||
|
||||
// Split the IP into 4 octects
|
||||
$octet = explode( ".", $target );
|
||||
|
||||
// Check IF each octet is an integer
|
||||
if( ( is_numeric( $octet[0] ) ) && ( is_numeric( $octet[1] ) ) && ( is_numeric( $octet[2] ) ) && ( is_numeric( $octet[3] ) ) && ( sizeof( $octet ) == 4 ) ) {
|
||||
// If all 4 octets are int's put the IP back together.
|
||||
$target = $octet[0] . '.' . $octet[1] . '.' . $octet[2] . '.' . $octet[3];
|
||||
|
||||
// Determine OS and execute the ping command.
|
||||
if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
|
||||
// Windows
|
||||
$cmd = shell_exec( 'ping ' . $target );
|
||||
}
|
||||
else {
|
||||
// *nix
|
||||
$cmd = shell_exec( 'ping -c 4 ' . $target );
|
||||
}
|
||||
|
||||
// Feedback for the end user
|
||||
$html .= "<pre>{$cmd}</pre>";
|
||||
}
|
||||
else {
|
||||
// Ops. Let the user name theres a mistake
|
||||
$html .= '<pre>ERROR: You have entered an invalid IP.</pre>';
|
||||
}
|
||||
}
|
||||
|
||||
// Generate Anti-CSRF token
|
||||
generateSessionToken();
|
||||
|
||||
?>
|
||||
21
dvwa/vulnerabilities/exec/source/low.php
Normal file
21
dvwa/vulnerabilities/exec/source/low.php
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'Submit' ] ) ) {
|
||||
// Get input
|
||||
$target = $_REQUEST[ 'ip' ];
|
||||
|
||||
// Determine OS and execute the ping command.
|
||||
if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
|
||||
// Windows
|
||||
$cmd = shell_exec( 'ping ' . $target );
|
||||
}
|
||||
else {
|
||||
// *nix
|
||||
$cmd = shell_exec( 'ping -c 4 ' . $target );
|
||||
}
|
||||
|
||||
// Feedback for the end user
|
||||
$html .= "<pre>{$cmd}</pre>";
|
||||
}
|
||||
|
||||
?>
|
||||
30
dvwa/vulnerabilities/exec/source/medium.php
Normal file
30
dvwa/vulnerabilities/exec/source/medium.php
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'Submit' ] ) ) {
|
||||
// Get input
|
||||
$target = $_REQUEST[ 'ip' ];
|
||||
|
||||
// Set blacklist
|
||||
$substitutions = array(
|
||||
'&&' => '',
|
||||
';' => '',
|
||||
);
|
||||
|
||||
// Remove any of the charactars in the array (blacklist).
|
||||
$target = str_replace( array_keys( $substitutions ), $substitutions, $target );
|
||||
|
||||
// Determine OS and execute the ping command.
|
||||
if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
|
||||
// Windows
|
||||
$cmd = shell_exec( 'ping ' . $target );
|
||||
}
|
||||
else {
|
||||
// *nix
|
||||
$cmd = shell_exec( 'ping -c 4 ' . $target );
|
||||
}
|
||||
|
||||
// Feedback for the end user
|
||||
$html .= "<pre>{$cmd}</pre>";
|
||||
}
|
||||
|
||||
?>
|
||||
Loading…
Add table
Add a link
Reference in a new issue