3

Is there a way to execute commands using directory traversal attacks?

For instance, I access a server's etc/passwd file like this

http://server.com/..%01/..%01/..%01//etc/passwd

Is there a way to run a command instead? Like...

http://server.com/..%01/..%01/..%01//ls

..... and get an output?

To be clear here, I've found the vuln in our company's server. I'm looking to raise the risk level (or bonus points for me) by proving that it may give an attacker complete access to the system

0

6 Answers 6

2

Chroot on Linux is easily breakable (unlike FreeBSD). Better solution is to switch on SELinux and run Apache in SELinux sandbox:

run_init /etc/init.d/httpd restart

Make sure you have mod_security installed and properly configured.

1

If you are able to view /etc/passwd as a result of the document root or access to Directory not correctly configured on the server, then the presence of this vulnerability does not automatically mean you can execute commands of your choice.

On the other hand if you are able view entries from /etc/passwd as a result of the web application using user input (filename) in calls such as popen, exec, system, shell_exec, or variants without adequate sanitization, then you may be able to execute arbitrary commands.

0

Unless the web server is utterly hideously programmed by someone with no idea what they're doing, trying to access ls using that (assuming it even works) would result in you seeing the contents of the ls binary, and nothing else.

Which is probably not very useful.

0

Yes it is possible (the first question) if the application is really really bad (in terms of security).

http://www.owasp.org/index.php/Top_10_2007-Malicious_File_Execution

0

Edit#2: I have edited out my comments as they were deemed sarcastic and blunt. Ok now as more information came from gAMBOOKa about this, Apache with Fedora - which you should have put into the question - I would suggest:

  • Post to Apache forum, highlighting you're running latest version of Apache and running on Fedora and submit the exploit to them.
  • Post to Fedora's forum, again, highlighting you're running the latest version of Apache and submit the exploit to them.
  • It should be noted, include the httpd.conf to both of the sites when posting to their forums.
  • To minimize access to passwd files, look into running Apache in a sandbox/chrooted environment where any other files such as passwd are not visible outside of the sandbox/chrooted environment...have you a spare box lying around to experiment with it or even better use VMWARE to simulate the identical environment you are using for the Apache/Fedora - try get it to be IDENTICAL environment, and make the httpd server run within VMWare, and remotely access the Virtual machine to check if the exploit is still visible. Then chroot/sandbox it and re-run the exploit again...
  • Document the step-by-step to reproduce it and include a recommendation until a fix is found, meanwhile if there is minimal impact to the webserver running in sandbox/chrooted environment - push them to do so...

Hope this helps, Best regards, Tom.

10
  • @gamBOOKa: check here stackoverflow.com/questions/1547012/where-hackers-hang-out
    – t0mm13b
    Feb 14, 2010 at 21:45
  • Please see edited question. It clarifies my position. I'm not a security person, in fact, our company does not have one. So I would like to get this issue fixed. My project manager is likely to disregard a read-only access vulnerability as opposed to a complete-access one.
    – HyderA
    Feb 14, 2010 at 21:46
  • @gAMBOOKa: Wow! A vulnerability - what kind of server are you running under for that to happen - Show your boss this page on SO and point your finger at this to see....unless you tell us what server...we perhaps may be able to help you...I think you should put that in your question, that your server is running software x. You will get a better response.... ;) If it's serious, your project manager SHOULD BE LISTENING TO YOU and not dismissing this as a 'read-only access vulnerability'.....
    – t0mm13b
    Feb 14, 2010 at 21:51
  • The directory traversal attack exists deep within an open source product we use. It's not a stupid SysAdmin issue. We run the latest version of Apache on Fedora btw. Exploiting our web server would at the very least hand over passwd and shadow file to the attacker as well as expose our source code to them.
    – HyderA
    Feb 14, 2010 at 21:56
  • I wonder what your boss would say if someone exploited this, and you said "Oh, I knew about this ages ago but I didn't tell anyone because I wanted to trump up how severe it was first".
    – Anon.
    Feb 14, 2010 at 22:00
0

If you already can view etc/passwd then the server must be poorly configured... if you really want to execute commands then you need to know the php script running in the server whether there is any system() command so that you can pass commands through the url.. eg: url?command=ls try to view the .htaccess files....it may do the trick..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.