I am trying to create a lab scenario wherein the "attacker" is intended to perform a directory transversal attack from an HTML page and move into the Windows system directories. Can I inject commands into CMD on the victim using the web browser? Can this even be done?
- The goal is to execute the system command prompt on the victim and inject commands using switches.
- Example: cmd /c ping www.google.com (this post has bearing but I can't seem to get it working)
- I'm not sure this is possible using the character set available in a URL string.
My current transversal string appears as such:
- If I substitue in
http://127.0.0.1/above and then run it from the host/victim system, a prompt to run cmd appears in the browser.
- Currently the html page is being run from a folder within "My Documents" though that will most likely be changed.
Target system is Windows 7, 8 or Server 2012. (Currently using 8 for testing)
- Vulnerable web page is being run by simple web-server 1.2
- This application is designed to be exploited by a transversal attack.
- Here is a youtube video that shows an example of the attack being performed against a Windows XP machine running the vulnerable software above to access the boot.ini file.
I've spent a fair amount of time googling this to see if it can be done yet I can't find specific information regarding syntax to inject commands into cmd. It appears that if I were to host my site on a linux system then the attacker might be able to use bash commands to perform the attack, but I am not sure about Windows.
I'm quite new to all this! I've done IT / Sys Admin for a while, but not penetration testing. I'd like to keep this as simple as possible, but I'm learning as well! Help is greatly appreciated!