Hack Security Pro.pdf - Index of

In this case, we can see that the “output-url” variable is a script confirming the client's data. If the CGI
is badly configurated, it is then possible to replace its value by:
And in this result would be displayed the file /etc/passwd
Another very common vulnerability is to call the system() function, which exists in the majority of
languages. This function enables the CGI program to create a child process which will execute the
command provided in the argument. Let us imagine the likely case where the CGI contains a call to
system() of the type:
system("variables1");
In this case, any argument passed to the “variable1” variable would be executed. A URL of the:
http://www.xxx.zzz/cgi-bin/test.cgi?variable1=cat%20/etc/passwd
type would display the entire passwd file of the system.
Of course a call of this type will never be seen in a script, however a widespread mistake will be to call
a system function, of the type:
system("/usr/bin/sendmail -t $variable1"); # in a script shell, or
sprintf(buffer, "/usr/bin/sendmail -t %s", variable1); // in a C program
system("buffer");
This function will send back an email to the address contained in variable1.
As we have seen in the section about escape shells, it is possible to have the system execute several
commands consecutively through the same command line. So, by giving this variable a value of the
type:
valeur1=test@test.com ; cat /etc/passwd
The call to the system function would become
The Hackademy DMP -118/209- SYSDREAM