0

I am practising on an older version of DVWA (1.0.7 iso image). In High Security settings, I am trying to perform command injection and this is the source code snippet I saw

$target = stripslashes( $target );

$octet = explode(".", $target);

if ((is_numeric($octet[0])) && (is_numeric($octet[1])) && (is_numeric($octet[2])) && (is_numeric($octet[3])) && (sizeof($octet) ==4) ) {
    $target = $octet[0].'.'.$octet[1].'.'.$octet[2].'.'.$octet[3];

    //rest of the code....
}

I tried various ways and I found that

  1. Spaces before the IP address, example, " 192.169.4.4" does not affect the server from executing the ping command.
  2. Space right after the IP address will cause an error about invalid IP.
  3. I read up on is_numeric function and found that hexadecimal and binary notations are not allowed (https://www.php.net/manual/en/function.is-numeric.php)
  4. I used Burp Suite to try various encodings but they don't seem to work.
  5. stripslashes function is used to remove backslashes but I am not sure how I can make use of this code, if it is possible.

Has anyone worked on this challenge? Any advice is appreciated.

0

The code snippet in your question is actually from the impossible level, not high. I'm not sure which one you're trying to beat.

The high level uses a blacklist approach:

    $substitutions = array(
        '&'  => '',
        ';'  => '',
        '| ' => '',
        '-'  => '',
        '$'  => '',
        '('  => '',
        ')'  => '',
        '`'  => '',
        '||' => '',
    );
    // Remove any of the charactars in the array (blacklist).
    $target = str_replace( array_keys( $substitutions ), $substitutions, $target );

There are a few ways to beat high, however at a quick glance the impossible level might not be beatable without additional bugs. You could still beat it via something like shellshock on an older system though as it forks to run ping.

1
  • Hi @wireghoul I see, so I may have gotten the wrong level then. Thanks
    – localacct
    Dec 10 '19 at 3:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.