Web Command Execution vulnerability

One, what is the command execution vulnerability:

Applications sometimes need to invoke some functions that execute system commands, such as systems in PHP, exec, shell_exec, PassThru, Popen, Proc_popen, and so on, and when the user can control the parameters in these functions, the malicious system commands can be stitched into the normal command. , which causes the command to execute the attack, which is the command execution vulnerability.

Second, the use of conditions:

1, apply the function calling Execute command

2, the user input as a parameter of the system command in the command

3, no filter or filter for user input is not strict

Third, vulnerability hazard:

1, an attacker can execute commands to obtain the desired information

2, the attacker can take the server and so on

Four, examples:

Example one:

Code:

<?php $arg = $_get[' cmd ');    if ($arg) {System ("$arg"); }?>

Visit: http://127.0.0.1/mingling/simple1.php?cmd=ping%20127.0.0.1

The "ping 127.0.0.1" command was executed.

650) this.width=650; "src=" Https://s2.51cto.com/wyfs02/M02/03/D5/wKiom1mhSCqRquRRAABG8Ph3pVk375.png "title=" 2017-08-26_180604.png "alt=" Wkiom1mhscqrqurraabg8ph3pvk375.png "/>

Example two:

<?php $arg = $_get[' cmd ');    if ($arg) {System ("PING-C 3 $arg"); }?>

Visit: Http://192.168.25.107/simple2.php?cmd=127.0.0.1;pwd

The PWD command was executed

650) this.width=650; "src=" Https://s4.51cto.com/wyfs02/M01/A2/86/wKioL1mhSpKwchuFAABd3q5AflU285.png "title=" 2017-08-26_181626.png "alt=" Wkiol1mhspkwchufaabd3q5aflu285.png "/>

Example three:

<?php $arg = $_get[' cmd ');    if ($arg) {System ("ls-al \" $arg \ ""); }?>

Visit: Http://192.168.25.107/simple3.php?cmd=/home%22;ifconfig%22

Executed the ifconfig command.

650) this.width=650; "Src=" https://s1.51cto.com/wyfs02/M02/03/D6/wKiom1mhS_PyLrHyAACEeRHaYWU317.png-wh_500x0-wm_ 3-wmp_4-s_23229392.png "title=" 3.png "alt=" Wkiom1mhs_pylrhyaaceerhaywu317.png-wh_50 "/>

Example four:

<?php eval ($_request[' code ');? >

When visiting: Http://192.168.25.107/simple4.php?code=phpinfo ();

Note the back of the semicolon, of course, can be followed by a word Trojan.

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M00/A2/86/wKioL1mhTSOCUcCpAAB08Yga69Y420.png-wh_500x0-wm_ 3-wmp_4-s_660029195.png "title=" 4.png "alt=" Wkiol1mhtsocuccpaab08yga69y420.png-wh_50 "/>

Example five:

<?php $fun = $_get[' fun '];    $par = $_get[' par ']; $fun ($par);? >

When visiting: Http://192.168.25.107/simple5.php?fun=system&par=whoami

In fact, it is the equivalent of executing:

System ("WhoAmI")

650) this.width=650; "Src=" https://s1.51cto.com/wyfs02/M02/03/D6/wKiom1mhTmXy7ri_AAAtxYR739k204.png-wh_500x0-wm_ 3-wmp_4-s_3769725770.png "title=" 3.png "alt=" Wkiom1mhtmxy7ri_aaatxyr739k204.png-wh_50 "/>

Five: Fix the solution:

1. Use as few functions as possible to execute commands or disable them directly

2. parameter values use quotation marks as far as possible include

3. Ensure that the function used is one of the specified functions before using dynamic functions

4. Filter the parameters before entering the function/method that executes the command, escaping the sensitive characters

Such as:

<?php $arg = $_get[' cmd ');    $arg = Addslashes ($arg);  $arg = Escapeshellcmd ($arg);    Processing if ($arg) {System ("Ls-al ' $arg ') before stitching; }?>

Escapeshellcmd () escapes any string in the string that might be used to spoof (trick) the shell command, which is used to determine that any data entered by the user has escaped before the data is transferred to EXEC () or system (), and the standard usage is as follows

Example: <?php System (Escapeshellcmd ($cmd));? >

Six: Reference Links:

1,http://haojiawei.xyz/2017/03/15/%e5%91%bd%e4%bb%a4%e6%89%a7%e8%a1%8c%e6%bc%8f%e6%b4%9e/

2,http://www.jianshu.com/p/1e706f13b088

650) this.width=650; "src=" Https://s3.51cto.com/wyfs02/M01/A2/86/wKioL1mhT0LBqM-9AAQF1aT1ixQ725.png "title=" Enjoy. png "alt=" Wkiol1mht0lbqm-9aaqf1at1ixq725.png "/>

This article is from the "Tiandaochouqin" blog, make sure to keep this source http://tdcqvip.blog.51cto.com/12995943/1959586

Web Command Execution vulnerability