the-web-application-hackers-handbook

360 Chapter 10 n Attacking Back-End Components
Figure 10-2: A successful command injection attack
Example 2: Injecting Via ASP
Consider the following C# code, which is part of a web application for administering
a web server. The function allows administrators to view the contents
of a requested directory:
string dirName = “C:\\filestore\\” + Directory.Text;
ProcessStartInfo psInfo = new ProcessStartInfo(“cmd”, “/c dir “ +
dirName);
...
Process proc = Process.Start(psInfo);
When used as intended, this script inserts the value of the user-supplied
Directory parameter into a preset command, executes the command, and
displays the results, as shown in Figure 10-3.
As with the vulnerable Perl script, an attacker can use shell metacharacters to
interfere with the preset command intended by the developer and inject his own
command. The ampersand character (&) is used to batch multiple commands.
Supplying a filename containing the ampersand character and a second command
causes this command to be executed and its results displayed, as shown
in Figure 10-4.