Dvwa vulnerability training system.
1. First, I tried the command execution vulnerability Command Execution of dvwa, which was tested at the low level and included the low level code:
<? PHP
If (isset ($ _ post ['submit ']) {// isset () function. If the variable is not null or null, true is returned.
$ Target = $ _ request ['IP']; // $ _ request [] obtain the content in the IP address tag <input id = "ip" type = "text">
// Determine OS and execute the ping command.
If (stristr (php_uname ('s '), 'windows nt') {// stristr () function, paste an example to determine whether it is windows or Linux, and php_uname () returns the description of the operating system that runs PHP,'S': Operating System name. /*<? PHP
$ Email = '[email protected]';
Echo stristr ($ email, 'E'); // output [email protected]
Echo stristr ($ email, 'E', true); // output from PhP 5.3.0
?>*/
$ Cmd = shell_exec ('ping'. $ target); // shell_exec () function invocation command
Echo '<PRE>'. $ cmd. '</PRE> ';
} Else {
$ Cmd = shell_exec ('Ping-C 3'. $ target); // run the Linux Command
Echo '<PRE>'. $ cmd. '</PRE> ';
}
}
?> |
It is found that $ target directly receives unfiltered values. In Windows and Linux, you can use & and; to execute multiple commands. Therefore, submit 127.0.0.1 & net user for testing.
Next is the medium-level code.
<? PHP
If (isset ($ _ post ['submit ']) {
$ Target = $ _ request ['IP'];
// Remove any of the charactars in the array (blacklist ).
$ Substitutions = array (// create a PHP array ('key' => 'value ')
'&' => '',
';' => '',
);
$ Target = str_replace (array_keys ($ substitutions), $ substitutions, $ target );/* Array_keys returns the array key name. The search parameter str_replace (search, replace, subject) matches the characters in the subject. If the match matches, replace is used instead */
// Determine OS and execute the ping command.
If (stristr (php_uname ('s '), 'windows nt') {// determines if it is Windows
$ Cmd = shell_exec ('ping'. $ target );
Echo '<PRE>'. $ cmd. '</PRE> ';
} Else {
$ Cmd = shell_exec ('Ping-C 3'. $ target );
Echo '<PRE>'. $ cmd. '</PRE> ';
}
}
?> |
Medium is filtered out, but you can try to submit 1 | net user | it means that if the previous execution is not successful
========================================================== = Not complete ==================================================== ========================
