Remote Code Execution (RCE) - Printable Version

Remote Code Execution (RCE) - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Remote Code Execution (RCE) (/Thread-Remote-Code-Execution-RCE)

Pages: 1 2

Remote Code Execution (RCE) - Boomslang - 07-03-2013

Hello HC,
I'm going to demonstrate you the Remote Code Execution vulnerability.

The main reason of this vulnerability is taking the un-filtered user input as a part of the command that will be executed.
Injection vulnerabilities (SQL, XPath, LDAP etc.) can be classified as RCE Vulnerabilities.

For example our source code will be like this;

PHP Code:
<html>
<a href="?cmd=echo %TIME%">View Time</a><br>
<? if(isset($_GET['cmd'])) print "<b>Current Time: </b> " . shell_exec($_GET['cmd']); ?>
</html> 

As you can see, our page is executing a MS-DOS command to view the current time.
Note: This is not necessary actually. We can simply use the date() function of Php to view the current time.

Back to our subject. There is a parameter named "cmd" that takes its value via GET method. As you can guess, we can manipulate that parameter and execute any MS-DOS command we like.
[Image: puvcz.png]

We just gathered information about BIOS. Imagine how many you can do with this vulnerability if the user had full access.

(07-05-2013, 01:32 AM)The Alchemist Wrote: Another form of this vulnerability can be :

Code:
<form action="add.php" method="post"> <textarea rows="20" cols="30" name="text"></textarea> <input type="submit" value="Submit" name="sub"/> </form>

add.php :

PHP Code:
<?php if(!empty($_POST['text'])) { $hand = fopen("some.php","a"); fwrite($hand,$_POST['text']); fclose($hand); } ?>

And when someone executes some.php.....

Another example:

Code:
<form action="#" method="POST">
<b>Enter your name:</b><br>
<input type="text" name="name"><br>
<input type="submit" value="Send"><br>
<br>
</form>
<?php
if(!empty($_POST['name'])){
$filename = "some.shtml";
$file = fopen($filename, 'w') or die ("File couldn't opened!");
$text = "Hello ".$_POST['name']."!";
fwrite($file, $text);
fclose($file);
print '<a href="some.shtml">Click Here To Go!</a>';
}
?>

If you put in name field a SSI command, It'll be saved to some.shtml and will be executed when you open it.

More example;

(07-05-2013, 07:54 PM)shp0ngl3 Wrote: This is a nifty little vuln with possible severe outcome if in wrong hands. I've seen several ping services that's vulnerable to this.

I've seen code similar to this

Code:
<?php $target = $_POST['target']; exec("ping {$target}", $output); foreach ($output as $line) { echo "{$line}<br />\n"; }

So, executing commands is as easy as in your own terminal

Code:
-c 0 google.com;ls -la /
or

Code:
-c 1 google.com && ls -la /

This is the logic of Remote Code Execution. To avoid this vulnerability, dont use the user input in your commands that will be execute. If you have to use, check and filter them properly.

I hope you'll like this tutorial Smile

Au Revoir..

RE: Remote Code Execution (RCE) - PVPPRO - 07-04-2013

Dude I wish I had know this earlier. A lot earlier. Thanks.

RE: Remote Code Execution (RCE) - The Alchemist - 07-05-2013

Another form of this vulnerability can be :

Code:
<form action="add.php" method="post">
<textarea rows="20" cols="30" name="text"></textarea>
<input type="submit" value="Submit" name="sub"/>
</form>

add.php :

PHP Code:
<?php
if(!empty($_POST['text']))
{
    $hand = fopen("some.php","a");
    fwrite($hand,$_POST['text']);
    fclose($hand);
}
?>

And when someone executes some.php.....

RE: Remote Code Execution (RCE) - The Alchemist - 07-05-2013

Another form of this vulnerability can be :

Code:
<form action="add.php" method="post">
<textarea rows="20" cols="30" name="text"></textarea>
<input type="submit" value="Submit" name="sub"/>
</form>

add.php :

PHP Code:
<?php
if(!empty($_POST['text']))
{
    $hand = fopen("some.php","a");
    fwrite($hand,$_POST['text']);
    fclose($hand);
}
?>

And when someone executes some.php.....

RE: Remote Code Execution (RCE) - The Alchemist - 07-05-2013

Another form of this vulnerability can be :

Code:
<form action="add.php" method="post">
<textarea rows="20" cols="30" name="text"></textarea>
<input type="submit" value="Submit" name="sub"/>
</form>

add.php :

PHP Code:
<?php
if(!empty($_POST['text']))
{
    $hand = fopen("some.php","a");
    fwrite($hand,$_POST['text']);
    fclose($hand);
}
?>

And when someone executes some.php.....

RE: Remote Code Execution (RCE) - Boomslang - 07-05-2013

(07-05-2013, 01:32 AM)The Alchemist Wrote: Another form of this vulnerability can be :

Code:
<form action="add.php" method="post"> <textarea rows="20" cols="30" name="text"></textarea> <input type="submit" value="Submit" name="sub"/> </form>

add.php :

PHP Code:
<?php if(!empty($_POST['text'])) { $hand = fopen("some.php","a"); fwrite($hand,$_POST['text']); fclose($hand); } ?>

And when someone executes some.php.....

Added your example to tutorial thanks Smile

Also It's the same for shtml documents.

RE: Remote Code Execution (RCE) - RogueCoder - 07-05-2013

This is a nifty little vuln with possible severe outcome if in wrong hands. I've seen several ping services that's vulnerable to this.

I've seen code similar to this

Code:
<?php
$target = $_POST['target'];
exec("ping {$target}", $output);
foreach ($output as $line) {
    echo "{$line}<br />\n";
}

So, executing commands is as easy as in your own terminal

Code:
-c 0 google.com;ls -la /

Code:
-c 1 google.com && ls -la /

Thanks for the share!

RE: Remote Code Execution (RCE) - Boomslang - 07-05-2013

@shp0ngl3 all based on same logic but more example better understanding. Added your example too thanks for feedback Smile