Cybersecurity series 11 system command injection attacks

System command injection attacks are also an old method of attack, which means that hackers can directly execute operating system commands in the address bar of a vulnerable page. The following will demonstrate how to implement this attack and how to configure WAF to intercept it. The experiment environment will still be built using npmserv.

Open the website and enter "? Cmd = the command to be executed ", as shown in http: // 192.168.1.3 /? Cmd = net user. You can find that the command can be successfully executed.

650) This. width = 650; "style =" border-bottom: 0px; border-left: 0px; border-top: 0px; border-Right: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201410/22/70821_1414017492o6is.png "Height =" 171 "/>

If a website is found to have such a vulnerability, the following operations are basically useless. It is nothing more than creating a user, joining the Administrator group, and opening another 3389. For specific operations, refer to the previous blog post "website Elevation of Privilege.

Configure WAF for defense.

The P-Deny policy is still configured. Create a rule named "nocmd" in "basic attack protection" and set "parameter" in the detection domain ", set "regular match" in the matching mode and set a regular expression in the value.

Here, according to the characteristics of the system command injection attack, I set the following regular expression:

.*? Cmd .*

As shown in:

650) This. width = 650; "style =" border-bottom: 0px; border-left: 0px; border-top: 0px; border-Right: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201410/22/70821_1414017493j8Wy.png "Height =" 377 "/>

If the command is injected again, an error is reported.

 

650) This. width = 650; "style =" border-bottom: 0px; border-left: 0px; border-top: 0px; border-Right: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201410/22/70821_1414017494R0Q9.png "Height =" 254 "/>

This article is from the "one pot of turbidity wine" blog. For more information, please contact the author!

Cybersecurity series 11 system command injection attacks