6

Given an attacker connects to a web server on port 80 and issues following command, what is he trying to accomplish?

/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0

I already read this is related to some old IIS vulnerability and I figure this is an attempt to get a shell, execute the dir command and then close the shell, but:

  • This seems to be useless since the output will be printed to stdout and not returned as a server response?
  • Also, why is it even possible to request files outside of the www directory? Should this not be forbidden per default?
  • What are the user privileges such an attacker has when he issues those commands in a self created shell? I guess the privileges of the running server.
  • Could a firewall prevent this attack and if not, are there other measures which could have prevented this?

Thanks a lot in advance!

  • 2
    If the server is badly configured, it would execute the cmd.exe file, give it the arguments, and send its output back to the user. If this succeeds the scanner will flag the host as vulnerable and the next command they'll try will be more evil. – André Borie Aug 1 '16 at 17:35
5

This seems to be useless since the output will be printed to stdout and not returned as a server response?

It depends on the vulnerability being exploited. Sometimes, an attacker can determine if a system is vulnerable to an attack based on the HTTP status code or the time it takes for the response to be returned. If the attacker can send an attack and learn that the system is vulnerable, they may send follow up attacks but if it didn't work, move on to try a different exploit.

There is no technical reason why a server couldn't process GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0 as executing the cmd.exe file and passing '/c dir' as arguments, capturing the output and sending it as a response to the user. It all depends on the design of the server that is being interacted with. In hindsight, this design is silly, as it allows attackers to take advantage of a system, but in the early years of the web, allowing this kind of access could have been desirable.

Also, why is it even possible to request files outside of the www directory? Should this not be forbidden per default?

Web servers are complicated and engineers make mistakes. Keep in mind that this type of attack is characteristic of the web in its infancy.

What are the user privileges such an attacker has when he issues those commands in a self created shell? I guess the privileges of the running server.

If an attacker could leverage such an exploit, it is probable that the attacker would get the privilege of the running server. But, the execution is going to happen according to however the program was written. Its also possible that the server could lower privileges before passing off the execution. That's not likely, but the point is that it always depends on the context of the system being exploited.

Could a firewall prevent this attack and if not, are there other measures which could have prevented this?

Yes and no. Firewall is a bit of an oversubscribed term, so some firewalls will have this capability and others will not. Some firewalls only focus on network traffic in the sense of source IP:port, destination ip:port, and don't look at the actual message being sent. Other firewalls include an Intrusion Prevention System or IPS. This is an application that compares the traffic to signatures of known bad traffic. So if the firewall has an IPS, and there is a rule for this traffic, it would be blocked.

0

You pack a lot of questions in here!

The server is likely to respond with a different status code depending on whether the command executes or not. In all likelihood, a well configured system would return a 500 internal server error, while a poorly configured system would return a 200, confirming that the command was executed. This would give an adversary information to proceed with an attack.

A properly configured system would limit access to the www directory, or other valid locations explicitly authorized. However, there's an entire class of vulnerability known as directory traversal, which is where you can escape from the authorized filesystem regions, often by something as simple as using "../.." in the URL. For example, here's one from 2014: https://issues.jboss.org/browse/WFLY-4020 Bugs exist in all software, and things that make perfect sense don't always happen as they should.

Correct, the shell execution would be in the context of the user running the web service. This is why you should never run a web server as root, to prevent an exploit in your web service from being an exploit to your whole box.

Finally, a well configured WAF might be able to prevent this attack. What typically defines a WAF is that it is content-aware with respect to web applications, and so it can inspect and discard requests that look bad. The devil is in the details though, so simply having a WAF is not enough.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.