0

Scenario is this.

I have logged into a web server as admin through the login page in browser. it has displayed me with an input box that with a button next to it saying "ping"

it essentially will ping an ip address that you input.

I know for a fact the service running on the web server is running as root.

my question is this. can i put in an IP address and then pipe a command after it to elevate my privileges?

For Example...

ping 192.168.0.1 | usermod -a -G <groupname> username

ping 192.168.0.1 | whoami

the command shell running the ping is running under root so in theory it should allow me to elevate a users privileges on the system? please correct me if i'm wrong.

Don't have anything to test on so hence the question.

thanks in advance

3
  • 1
    This is probably better suited for Security. Oct 21, 2014 at 4:54
  • Ahhh thanks, didn't even realize there was a separate site. Oct 21, 2014 at 4:55
  • So you want to test the security of an imaginary service? I don't know you, but if I were to create a ping utility like this, I'd first check that you give me an ip before interpreting anything... Moreover I'd use a lib like liboping
    – Jaffa
    Oct 21, 2014 at 4:57

1 Answer 1

1

This question cannot be answered with a certain "yes" or "no" without seeing the code or being able to explore the system.

It all really depends on the web app. If they're simply concatenating your input onto the end of ping and then execing that command, then yes, what you show is possible.

On the other hand, if they're properly sanitizing inputs (e.g. ensuring the input is only an IP address), or using some other implementation (e.g. a Ping library), then it may not be vulnerable.

1
  • Thanks for your answer. I understand what you mean and from playing around with it a few weeks ago it doesn't seem to sanitize inputs. You can input /../../../../../var/ and it will return with a "this page cannot be found on this web server". not an invalid ping request or anything like that, seems to just accept what you put into it. Oct 21, 2014 at 5:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.