From 7f3bb8d26d5331658baea9182265a4975ad42abf Mon Sep 17 00:00:00 2001 From: Madhav Mehndiratta Date: Wed, 22 Mar 2023 03:11:50 +0530 Subject: [PATCH] Create: Command Injection Lab 2 --- Solutions/solution.md | 11 ++++++- introduction/templates/Lab/CMD/cmd.html | 34 ++++++++++++++++++-- introduction/templates/Lab/CMD/cmd_lab2.html | 32 ++++++++++++++++++ introduction/urls.py | 1 + introduction/views.py | 19 +++++++++++ 5 files changed, 94 insertions(+), 3 deletions(-) create mode 100644 introduction/templates/Lab/CMD/cmd_lab2.html diff --git a/Solutions/solution.md b/Solutions/solution.md index 56e9f8310..769ee62bd 100644 --- a/Solutions/solution.md +++ b/Solutions/solution.md @@ -21,7 +21,7 @@ On Successful injection ![image](https://user-images.githubusercontent.com/61360833/118371252-5986ea00-b5c9-11eb-9efb-6beedd558f56.png) -### Command Injection +### Command Injection Lab 1 The user on accessing the lab is provided with a feature to perform a name server lookup on the given domain. The user has to give a domain name and the server would perform a ns lookup and return back to the client. If the user is running the lab, based on the OS he can select Windows or Linux. The user can cause the server to execute commands ,because of the lack of input validation. @@ -38,6 +38,15 @@ This should give you the output for both`ns lookup` as well as for the `ifconfig ![cmd_inj_2](https://user-images.githubusercontent.com/70275323/154504361-4baa73cb-f73b-44a8-8769-0af2e7b53c24.png) +### Command Injection Lab 2 +We are given an input form where we can calculate basic arithmetic expressions. Our task is to exploit this functionality and achieve code execution. + +This lab is using `eval()` function in backend which is used to evaluate expression in python. If the expression is a legal python statement, then it will be executed. + +If we submit the expression `1 + 1`, we get the output as `2`. Similarly, on submitting the expression `7 * 7`, we get the output as `49`. + +Now, if we submit `os.system("id")`, we get nothing in the output. But if we check the terminal, we will see that the command gets executed and the result is printed on the terminal screen. You can also verify this by submitting `os.system("sleep 30")`, and you will notice that the request completes after 30 seconds. + ## A2:Broken Authentication The main aim of this lab is to login as admin, and to achieve this, exploit the lack of `rate limiting` feature in the otp verification flow. You can see that the otp is only of 3 digit(for demo purposes) and neither does the application have any captcha nor any restriction on number of tries for the otp. diff --git a/introduction/templates/Lab/CMD/cmd.html b/introduction/templates/Lab/CMD/cmd.html index 43886a3bb..bfea5917f 100644 --- a/introduction/templates/Lab/CMD/cmd.html +++ b/introduction/templates/Lab/CMD/cmd.html @@ -14,7 +14,7 @@

What is Command Injection

attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

- +

This lab helps us to understand how command injection is exploitable in scenarios where inputs are sent @@ -81,8 +81,38 @@

What is Command Injection

+ + +
+

+ This is another lab to understand code execution. There are some functions in python such as eval(), exec() which can be used to achieve code execution. +

+ In this lab, we will be learning about the eval() function in python3. The eval() function evaluates the specified expression, if the expression is a legal Python statement, it will be executed. + +
+ +
Challenge Description:
+ In this challenge, we are given an input box, where we can calculate any arithmetic expression such as 1 + 1 or 5 * 5 etc. + Your task is to exploit this input form and achieve command execution on the system. +

+ Challenge Solution:
+ We know that this application is using the eval() function in the backend to calculate the output. Instead of submitting arithmetic expressions, we can also submit python3 commands, which will be executed by the eval() function. +

+ First, if we submit the expression 1 + 1, we get the output as 2. Similarly, on submitting the expression 7 * 7, we get the output as 49. +

+ Now, if we submit os.system("id"), we get nothing in the output. But if we check the terminal, we will see that the command gets executed and the result is printed on the terminal screen. You can also verify this by submitting os.system("sleep 30"), and you will notice that the request completes after 30 seconds. +

+

+ +
+
+ +

+
+
-

Mitigation


+

Mitigation