Hello, in this laboratory, we will experience exploitation and mitigation of an OS command injection
vulnerability.
I have set up a very simple feature on this page.
The user can select the type of data via the combo box and by pressing the button, the value relating
to the choice is displayed with a postback.
Each type of combo box value corresponds to the display when the page is reloaded of an environment
variable of the web server. For how the page functions and the values displayed
It can therefore be assumed that there is the invocation of some operating system shell command
on the server side.
So.
Command that reads and returns values of environment variables.
So if you presume this, you can go on to test if an attack could be successful.
Let's go to the Chrome developer's tools
And let's identify the combo box, the Select tag, in the DOM of the page. The Select tag has three option
elements with their values
set to recall three server-side environment variables or commands.
These are the
echo %username%, the date/t, echo %cd%, which are precisely the three operating system commands
invoked server-side.
OK.
So.
Let's try to modify the value of the second option element.
We replace the whoami command instead of the date/t command.
And it displays the user's name, or
We can insert now the command dir and then we can see all the server side content of the current directory.
OK, so.
Let's try to see how to mitigate the vulnerability.
Now, I remove the comment to a conditional Switch block, which is used to check if the command you
want to execute falls within one of the acceptable values or otherwise you exit the page load without
doing anything.
So in practice, a white list of acceptable commands is created, any other command not included
is discarded.
Let's try now
to run the laboratory again with the mitigation.
The page
without malicious injection works as before.
ok
Now, i activate the developer tools again.
And now.
Inject a shell command dir into the second option element as before, but this time trying to click the
button to execute the injected command
It is not executed.
So thank you.