Online Tracert (Ping) Security

 

Similarly, today I accidentally discovered --#

Simulate the code locally.

Explanation: the first statement echo the submitted content and the second statement executes the tracert command and returns

Since it is the URL that tracert wants to track, it is not possible to tracert 0.0.0.0 & net user. Of course, the result will not work, because the browser will parse & into & net user

This becomes the key (& user = xxx & pass = xxxxx), so we need to encode & % 26

Finally, we submitted 2.php? Tracert = 0.0.0.0% 26net % 20 user

Result

In this way, if the permission is large enough, it is sufficient to escalate the permission to the server.

Solution

Since the URL contains any special characters except "." and "-",

We add

$ Badword = '! | @ | # | & | <|> '; If (preg_match ("/$ badword/I", $ _ GET ["tracert"]) {exit ('bad request  
 
Let's submit it again.
 
 
From: network security technology blog (www.safe121.com)