4.3 Lab: Blind OS command injection with output redirection | 2024

10 months ago 126

BOOK THIS SPACE FOR AD

ARTICLE AD

This lab contains a blind OS command injection vulnerability in the feedback function. The application executes a shell command containing the user-supplied details. The output from the command is not returned in the response. However, you can use output redirection to capture the output from the command | Karthikeyan Nagaraj

This lab contains a blind OS command injection vulnerability in the feedback function.

The application executes a shell command containing the user-supplied details. The output from the command is not returned in the response. However, you can use output redirection to capture the output from the command. There is a writable folder at:

/var/www/images/

The application serves the images for the product catalog from this location. You can redirect the output from the injected command to a file in this folder, and then use the image loading URL to retrieve the contents of the file.

To solve the lab, execute the whoami command and retrieve the output.

Click submit feedbackType some dummy values, capture the request, and send it to the repeaterAdd this payload at the end of the email parameter
||whoami>/var/www/images/output.txt||The above payload will execute whoami command and store the result in output.txt which will be created in /var/www/images because, as per the lab description /var/www/images/ is a writable folder.Go to the lab, right-click an image, and click Open Image in New TabIn the Url bar remove the filename and add output.txtYou can now see the result, if not, open the http history in Burp to view it.The lab will be solved once you send the requestfilename=output.txt

YouTube Channel for Cybersecurity Lab’s Poc and Write-ups

Telegram Channel for Free Ethical Hacking Dumps

Thank you for Reading!

Happy Ethical Hacking ~

Author: Karthikeyan Nagaraj ~ Cyberw1ng

Read Entire Article