Chapter 20 attacking a web server
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
We will now copy the required files from the disk enclosed with the set.
Now let's have a look at our first example.
It will demonstrate five methods for remote execution of a command on the HP script level
will copy our script into the target server and see how it works.
As we can see we manage to execute the command from the script level.
However it often happens that this possibility is blocked to block dangerous functions it is necessary
to edit the Ph.
D I N I file
after restarting the Apache server the configuration changes should be applied.
The next example we will look at allows us to list the content of the directory and to read the indicated
file
to limit access only to a defined area.
It is necessary to use the open underscore base dir option will modify the p doc I and I file
as we can see after updating the settings access to the directories has been blocked.
The next example demonstrates how the function built into the script code works.
Our next task will be to rewrite this function in the C language and to use the module We created by
doing this.
After compiling we obtain the binary form of our module with the name test.
S-O to use our module in the script.
We use the DL function
as we can see the module cannot be uploaded.
We will therefore make a small modification to the path of our module.
It worked and we have taken advantage of the function available in the external module created earlier
with success.
The next task will be to prepare a module that will allow us to list a directory and to execute any
command
before starting the compilation of a module.
We will modify the makefile file.
Let's upload the script code and the binary form of the module into the server and check its functioning
and practice
as we can see it worked as we wished.
We have successfully read data from the indicated file and listed the directory content
to exclude the possibility of loading external modules we add the function to the list of blocked commands.
Let's try now to use our module on another server.
As we can see the module couldn't be uploaded due to the lack of compatibility with the version of HP
in use we need to compile the module without using the debugger symbols.
An alternative solution is the use of macros to deceive a compiler which will allow us to force the
upload of the module
with the right ph version.
We can compile the module using the required settings
after configuration we can proceed with the HP compilation this operation can take a couple of minutes.
Finally we install the new p p version in the system using the make install command
with the new HP version.
We will now make a small change to the make file file compiler module and copy it to the server.
As we can see all went according to plan and the code of our module has been executed correctly.
Let's now try to deceive the compiler by using the macros mentioned earlier to do this.
We will modify the module code
we've been successful the use of the appropriate compiler macros allowed us to execute the module correctly
another obstacle we can encounter while using the external modules is the safe mode
as we can see switching on the safe mode effectively prevents us from using our module
we can obtain information on the HP environment options using the P HP info function.
If all the possibilities known to us have been switched off we can check the susceptibility of other
modules offered by the server in error in the kernel module for example allows us to remove the limitations
introduced by Safe Mode and read the file content.
Another method to circumvent the security precautions is the use of the CGI scripts
before starting up our script should possess the execute ability attribute we assigned this with the
S.H. mode command.
We did it.
So let's try now to use the ability to start up CGI programs on a more ambitious example.
If we lack access to the shell we can also use the CGI script in the compiled file.