Sometimes, for some reason, Web applications try to perform tasks by executing system level commands.
So in order to run Goodman's Web applications, communicate with the U.S..
So if an application doesn't do this properly, this functionality can be exploited.
So the U.S. command injection vulnerabilities occur at this crossroads.
So due to insufficient input validation, a user can inject those commands via a web interface like
an actual injection.
And these commands will be executed by the Web server OS now, depending on the level of privilege that
the Web server software has, the result can be devastating.
Don't let's fool ourselves.
So open up, Carly, and log in to be Web.
Choose OS command injection.
And it's a sample page doing OS level things.
And it shows the DNA information for the input value.
Now, I would avoid querying the NSA, but you can go ahead and do it.
No, strike that from the record.
OK, so type Google dot com and look it up.
So something does happen.
What is it?
So let's view this horse.
So maybe we've got something here.
Oh, nothing's here either, so go back.
Open your terminal.
Now I'm going to view the code.
So scrolling down.
OK, so based on levels, it looks like there are some security checks.
We can look for Jack one and check two later, so keep scrolling down.
So here's the main part.
As you can see, the page use shell exactly is a built in function to execute and as up command on the
operating system.
So that's all here.
The functions are in this file.
So here are the command injection check functions.
So the first one clears the ampersand and the semicolon.
And the second function calls for a built in function escape command show, so this function is used
to escape system commands.
OK, enough with the code.
Now, after the NSA Look-Up Command comes the target, so in a low level, there's no check.
We can run several OS commands after the target by adding some special characters.
Now, let's delete the NSA address type, Google dot com and WD and then go.
And we see the BW rectory.
Oh, I'm so bored by deleting the NSA each time, but.
I'm just a little paranoid, so let's enable Foxe proxy.
We can choose from autocomplete.
And go to.
Nothing change here.
So send it to the repeater and then let it go.
Over the repeater now.
Yeah, I think I think he like this, too.
I know, I do.
It's really handy, though, right?
Never mind, so send the first request as it is.
And yeah, so we can get the response.
And then now we can modify it here.
You can do it however you want.
I have a list.
I'm going to share it with you so you can try to cut while many possibilities.
What do I hear you say, where's the password file?
No, I didn't forget it.
It's here.
I with what I do, it's actually routine, so I find the vulnerability, then display some important
files and I try to open a basic reverse shell with Netcare at.
And I typically do not break my routine.
So I'll type which ency?
And scrolling down, yeah, it's here.
So now I'm going to paste the one line that Cashell.
And before sending let me make Nat Cat listen.
So now Neck Cat listens for incoming connections.
And go to the repeater again.
Click on the send button.
Well, I think we got the show because there's nothing here on the right pane, so let's open up the
terminal.
And see the shell from B box so you can type some bash commands, I.D., you name.
Who am I?
Just like that.