Remote Code Execution (RCE)
I'm going to demonstrate you the Remote Code Execution vulnerability.
The main reason of this vulnerability is taking the un-filtered user input as a part of the command that will be executed.
Injection vulnerabilities (SQL, XPath, LDAP etc.) can be classified as RCE Vulnerabilities.
For example our source code will be like this;
![[Image: puuwl.png]](http://u1307.hizliresim.com/1c/3/puuwl.png)
As you can see, our page is executing a MS-DOS command to view the current time.
Note: This is not necessary actually. We can simply use the date() function of Php to view the current time.
Back to our subject. There is a parameter named "cmd" that takes its value via GET method. As you can guess, we can manipulate that parameter and execute any MS-DOS command we like.
![[Image: puvcz.png]](http://j1307.hizliresim.com/1c/3/puvcz.png)
We just gathered information about BIOS. Imagine how many you can do with this vulnerability if the user had full access.
Another example:
If you put in name field a SSI command, It'll be saved to some.shtml and will be executed when you open it.
More example;
This is the logic of Remote Code Execution. To avoid this vulnerability, dont use the user input in your commands that will be execute. If you have to use, check and filter them properly.
I hope you'll like this tutorial
I'm going to demonstrate you the Remote Code Execution vulnerability.
The main reason of this vulnerability is taking the un-filtered user input as a part of the command that will be executed.
Injection vulnerabilities (SQL, XPath, LDAP etc.) can be classified as RCE Vulnerabilities.
For example our source code will be like this;
PHP Code:
<?php <html>
<a href="?cmd=echo %TIME%">View Time</a><br>
<? if(isset($_GET['cmd'])) print "<b>Current Time: </b> " . shell_exec($_GET['cmd']); ?></html> As you can see, our page is executing a MS-DOS command to view the current time.
Note: This is not necessary actually. We can simply use the date() function of Php to view the current time.
Back to our subject. There is a parameter named "cmd" that takes its value via GET method. As you can guess, we can manipulate that parameter and execute any MS-DOS command we like.
Image has been scaled down 16% (676x202). Click this bar to view original image (799x238). Click image to open in new window.
We just gathered information about BIOS. Imagine how many you can do with this vulnerability if the user had full access.
(07-05-2013 02:32 AM)The Alchemist Wrote: Another form of this vulnerability can be :
Code:
<form action="add.php" method="post">
<textarea rows="20" cols="30" name="text"></textarea>
<input type="submit" value="Submit" name="sub"/>
</form>
add.php :
PHP Code:
<?phpif(!empty($_POST['text']))
{
$hand = fopen("some.php","a");
fwrite($hand,$_POST['text']);
fclose($hand);
}?>
And when someone executes some.php.....
Another example:
Code:
<form action="#" method="POST">
<b>Enter your name:</b><br>
<input type="text" name="name"><br>
<input type="submit" value="Send"><br>
<br>
</form>
<?php
if(!empty($_POST['name'])){
$filename = "some.shtml";
$file = fopen($filename, 'w') or die ("File couldn't opened!");
$text = "Hello ".$_POST['name']."!";
fwrite($file, $text);
fclose($file);
print '<a href="some.shtml">Click Here To Go!</a>';
}
?>If you put in name field a SSI command, It'll be saved to some.shtml and will be executed when you open it.
More example;
(07-05-2013 08:54 PM)shp0ngl3 Wrote: This is a nifty little vuln with possible severe outcome if in wrong hands. I've seen several ping services that's vulnerable to this.
I've seen code similar to this
Code:
<?php
$target = $_POST['target'];
exec("ping {$target}", $output);
foreach ($output as $line) {
echo "{$line}<br />\n";
}
So, executing commands is as easy as in your own terminal
orCode:
-c 0 google.com;ls -la /
Code:
-c 1 google.com && ls -la /
This is the logic of Remote Code Execution. To avoid this vulnerability, dont use the user input in your commands that will be execute. If you have to use, check and filter them properly.
I hope you'll like this tutorial
0 comments:
Post a Comment