the-web-application-hackers-handbook

362 Chapter 10 n Attacking Back-End Components
TRY IT!
http://mdsec.net/admin/5/
http://mdsec.net/admin/9/
http://mdsec.net/admin/14/
Injecting Through Dynamic Execution
Many web scripting languages support the dynamic execution of code that is
generated at runtime. This feature enables developers to create applications that
dynamically modify their own code in response to various data and conditions.
If user input is incorporated into code that is dynamically executed, an attacker
may be able to supply crafted input that breaks out of the intended data context
and specifies commands that are executed on the server in the same way as if
they had been written by the original developer. The first target of an attacker
at this point typically is to inject an API that runs OS commands.
The PHP function eval is used to dynamically execute code that is passed to
the function at runtime. Consider a search function that enables users to create
stored searches that are then dynamically generated as links within their user
interface. When users access the search function, they use a URL like the following:
/search.php?storedsearch=\$mysearch%3dwahh
The server-side application implements this functionality by dynamically
generating variables containing the name/value pairs specified in the storedsearch
parameter, in this case creating a mysearch variable with the value wahh:
$storedsearch = $_GET[‘storedsearch’];
eval(“$storedsearch;”);
In this situation, you can submit crafted input that is dynamically executed
by the eval function, resulting in injection of arbitrary PHP commands into
the server-side application. The semicolon character can be used to batch commands
in a single parameter. For example, to retrieve the contents of the file
/etc/password, you could use either the file_get_contents or system command:
/search.php?storedsearch=\$mysearch%3dwahh;%20echo%20file_get
_contents(‘/etc/passwd’)
/search.php?storedsearch=\$mysearch%3dwahh;%20system(‘cat%20/etc/
passwd’)
NOTE The Perl language also contains an eval function that can be
exploited in the same way. Note that the semicolon character may need to
be URL-encoded (as %3b) because some CGI script parsers interpret this as a
parameter delimiter. In classic ASP, Execute() performs a similar role.