the-web-application-hackers-handbook

Chapter 10 n Attacking Back-End Components 359
print “$command\n”;
print end_html;
When used as intended, this script simply appends the value of the usersupplied
dir parameter to the end of a preset command, executes the command,
and displays the results, as shown in Figure 10-1.
Figure 10-1: A simple application function for listing a directory’s contents
This functionality can be exploited in various ways by supplying crafted input
containing shell metacharacters. These characters have a special meaning to
the interpreter that processes the command and can be used to interfere with
the command that the developer intended to execute. For example, the pipe
character (|) is used to redirect the output from one process into the input of
another, enabling multiple commands to be chained together. An attacker can
leverage this behavior to inject a second command and retrieve its output, as
shown in Figure 10-2.
Here, the output from the original du command has been redirected as the
input to the command cat/etc/passwd. This command simply ignores the
input and performs its sole task of outputting the contents of the passwd file.
An attack as simple as this may appear improbable; however, exactly this type
of command injection has been found in numerous commercial products. For
example, HP OpenView was found to be vulnerable to a command injection
flaw within the following URL:
https://target:3443/OvCgi/connectedNodes.ovpl?node=a| [your command] |