8 ms·
Exec($_GET
- distracteddev90 13y agoI don't get this?
- Cymen 13y agoIt is showing example of the PHP exec call running based on a GET parameter from a request. A really big security hole. http://www.php.net/manual/en/function.exec.php http://www.php.net/manual/en/function.exec.php http://www.php.net/manual/en/reserved.variables.get.php http://www.php.net/manual/en/reserved.variables.get.php
- jamestanderson 13y agoThis shows, in a very public way, a bunch of instances where code explicitly allows for arbitrary code execution (a security no-no.)
- BHSPitMonkey 13y agoIt's a large quantity of instances of PHP code that executes arbitrary user input (URL parameters) on the server.
- patopop007 13y agoIts mean to show all the projects on Github that are vulnerable to injection attacks. An attack can maliciously create a GET request that escapes out the current command and then execute arbitrary commands.
- adamnemecek 13y agoIt's a really dumb RCE exploit. Like maybe the dumbest there can be.
- revscat 13y agoIt is executing shell commands based on what you pass in through a request parameter. Since there is no filtering going on, you could, I suppose, pass in an entire bash script and have a good ol' time.
- mikeytown2 13y agoI found a legit repo for this code https://github.com/andresriancho/w3af-moth https://github.com/andresriancho/w3af-moth "A set of vulnerable PHP scripts used to test w3af's vulnerability detection features."
- elwell 13y agoWhich points out that the context has to considered as well. E.g., if it's a personal intranet or password protected page, this may not be vulnerability.
- utunga 13y agoYes. No.
- xai 13y agoWhat if a hacker would have access to a user of said personal intranet, or would find a way to bypass the password protected page. Then he'd be able to execute anything on the server, even stuff the user he hacked shouldn't be able to access. So no, this is always a vulnerability.
- vz0 13y agoWhat about phpMyAdmin and others alike webapps? Are they inherently insecure?
- deleted 13y ago[deleted]
- coldtea 13y agoThose are different, as they only do what they are meant to do (give access to the databases). They don't give untintended full access to the web server. That said, they are a little insecure.
- 13y ago
- kingnight 13y agoSomething like this might make a great feature for github — exploit code review warnings/alerts.
- ghayes 13y agoIt would actually be a nice to build an optional warning feature into `git` itself. You could download some known common issues and the script would generate warnings if you checked in corresponding code. E.g. git add id_rsa WARNING: You may have just staged a private key. or better echo '{"password": "mypassword"}' > config.json git add config.json WARNING: You may have just staged a password.
- lloeki 13y agoWrite git hooks and share them as "git-lint"
- bananas 13y agoProving once and for all that if you give someone a hand grenade, they'll go marching around with the pin out on the street.
- catmanjan 13y ago"We've found 99,841 code results" Someone should write a script that automatically raises an issues for each line and each project, it's probably possible, but I'm chronically lazy.
- rplnt 13y agoAs noted in other comment(s), there are legit uses for this.
- ircmaxell 13y agoCan you please provide just one? No other comment does that. And to be clear, I'm talking about providing at least one legit use for passing user input directly to exec without any kind of filtering...
- scott_karana 13y agoThe sourcecode of a hypothetical Github commenting bot searching for this vulnerability will have the same search token, and will be flagged.
- andrewryno 13y agoA great example is: https://github.com/andresriancho/w3af-moth https://github.com/andresriancho/w3af-moth He deliberately wrote vulnerable code to test his auditing script. There are more repos like this.
- ircmaxell 13y agoThat's fair. But that's also the vast minority of these results that I can tell...
- TheCoelacanth 13y agoTest cases for a PHP vulnerability scanner[1] [1] https://news.ycombinator.com/item?id=7665232 https://news.ycombinator.com/item?id=7665232
- deckiedan 13y agoAs a theoretical aside, I wonder if it'd be possible to have a typesystem based solution to these kinds of problems - where variables coming from the user (or from another program) are considered 'unsafe' and the compiler refuses to let exec() or whatever use them until they've been through a cleaner/tester of some kind... (OK, I know PHP doesn't have a compiler as such - but a static checker of some kind could work the same...)
- gst 13y agohttps://en.wikipedia.org/wiki/Taint_checking https://en.wikipedia.org/wiki/Taint_checking
- _pmf_ 13y agoOf note is that Perl had this since at least 1998. See http://gunther.web66.com/FAQS/taintmode.html http://gunther.web66.com/FAQS/taintmode.html But of course we just laugh about Perl and pat ourself on our backs with our safe new languages because we clearly know much more than those anachronistic neckbeards.
- Silhouette 13y agoBut of course we just laugh about Perl and pat ourself on our backs with our safe new languages And there is some justification for that: if those "safe new languages" are doing the type checking at compile time, that is better than only finding out you have a safety issue when you fail at run time.
- brohee 13y agoThe issue I have with Perl taint checking is that data is untainted by a group match within a regexp. It's not explicit enough and it's easy enough to find legitimate code with accidental untainting of dangerous data. Ruby requires an explicit untaint call, and IMHO it's the right way to go.
- deckiedan 13y agoAh, "Taint" was the missing magic word I couldn't figure out to aid my google-fu (well, duckduckgofu...). Thanks for that - there is a lot of interesting stuff out there. :-)
- hashx 13y agoDirectly passing user data to the command line is highly dangerous.It allows an attacker to execute arbitrary commands on the command line [0]. escapehellarg [1] has to be used to Escape a string to be used as a shell argument [0] http://gcattani.co.vu/2013/03/a-tale-of-a-php-shell/ http://gcattani.co.vu/2013/03/a-tale-of-a-php-shell/ [1] http://php.net/manual/en/function.escapeshellarg.php http://php.net/manual/en/function.escapeshellarg.php
- fleitz 13y agoDirectly doing anything with attacker supplied data is generally a no-no. Everything that may come from a user must be filtered, escaped or generally treated as hostile. As an example on an IRC channel someone once made their chan bot log the channel to the web, all it took was pasting javascript into an IRC window, and typing "LOL look at this! http://stupidbot.com/ircweblog" http://stupidbot.com/ircweblog". Channel pwned.
- rallemoose 13y agoMeet his brother https://github.com/search?q=eval%28%24_GET&type=Code&ref=searchresults https://github.com/search?q=eval%28%24_GET&type=Code&ref=sea... (eval($_GET
- lauriswtf 13y agoAlso relevant - https://github.com/search?q=mysql+%24_GET&type=Code&ref=searchresults https://github.com/search?q=mysql+%24_GET&type=Code&ref=sear...
- bowlofpetunias 13y agoThe names of the files alone suggests many of these are quite deliberate.
- elwell 13y agomost of those are demonstrations of the vulnerability
- nathancahill 13y agoNote that most of these are intentional. pointer.jpg.php, pypwn/test.php, w3af-moth, etc.
- VMG 13y agoAre there any more sophisticated parses that also find the non-obvious cases? It should be easily doable to write a tool that finds an exec() of a variable that was assigned a $GET etc
- theon144 13y agoI think it's easier to just avoid exec() altogether...
- VMG 13y agoTrue, but there is a lot of software out there where people don't do that. Might be interesting to find vulnerabilities that are slightly less obvious.
- Xylakant 13y agoSadly, there's cases where exec() is impossible to avoid - for example, every kind of tool that doesn't have a proper library and language bindings. See git and the grit library for an example.
- WestCoastJustin 13y agoAs a side note, this is how many SQL injection attacks happen too. You almost never want unfiltered user input to directly interact with your system. A while back, I did an episode on how SQL injection can lead to code execution by using unfiltered user input on a LAMP stack. See it @ http://sysadmincasts.com/episodes/21-anatomy-of-a-sql-injection-attack-leading-to-code-execution http://sysadmincasts.com/episodes/21-anatomy-of-a-sql-inject...
- ASneakyFox 13y agoSide side note. This same carelessness is what caused the heart bleed bug.
- Kim_Bruning 13y agoWell, in a sense maybe, but not on purpose there. The programmer had missed a bounds check.
- ASneakyFox 13y agoI think you're giving him too much credit. The input was not sanitized. Now its no one programmers fault. It was a long living bug many had a chance to see it and correct it for a long time. It was rooted in the same carelessness as exec(GET)
- mattwritescode 13y agoThats a little more than concerning!
- ephemeralgomi 13y agoThis is awful. Shell commands are not guaranteed to be idempotent, people! These should all be of the form exec($_POST, not exec($_GET.
- RutZap 13y agoI think the problem here is the fact that tainted variables (user input) are used to execute shell commands. it doesn't matter if that's $_POST or $_GET, both of these are user input and therefore these are huge vulnerabilities.
- saurik 13y ago"That's the joke."
- masklinn 13y agoI'm pretty sure GP was being sarcastic.
- RutZap 13y agoWhoops! My bad.. now I feel stupid :)
- huseyinkeles 13y agoI think he is being sarcastic.
- oleganza 13y agoI think he was indeed sarcastic.
- deleted 13y ago[deleted]
- gnurag 13y agoI think he is indeed being sarcastic.
- chriskottom 13y ago88,846 PHP 1,420 HTML+ERB 1,177 JavaScript 1,128 HTML 423 Ruby 250 XML 160 Markdown 117 Emacs Lisp 91 INI 65 Perl
- catkin 13y agoNot actually so surprising considering `$_GET` is a PHP superglobal.
- sprobertson 13y agoThough I'm surprised how many aren't PHP, for example all the Ruby repos... Edit: ah, most of those are Metasploit scripts.
- devsmt 13y agotry "exec params" and "call request" for shooting your foot in other languages
- jafingi 13y agoThis seems pretty secure.. https://github.com/searchmanipulator/missteencincinnati/blob/74935fb8fba65ca033d899aedeeccd3feec12015/wp-content/plugins/ezpz-one-click-backup/functions/ezpz-archive-cmd.php https://github.com/searchmanipulator/missteencincinnati/blob...
- DanOWar 13y agoExample from the Github search: <?php $result=shell_exec("cat ".$_GET['name'].".txt"); echo $result; ?> How to abuse: $_GET['name'] = "/dev/null; rm -rf /; echo ";
- xikrib 13y agoneed root access, no?
- LeonM 13y agoThats not the point. Of course "rm -rf /" won't work, but what about downloading and installing a backdoor? Or modifying the website scripts itself? Or dumping a database? Or... Removing all the files from a filesystem is something only a script kiddy would do, and it's probably a "best case scenario" for the owner of the server, because the impact of that is relatively small (just re-install the server and restore the backups). But once the attacker starts injecting mallware, stealing customer information (credit card numbers anyone?) or anything else nasty they can think of that they would benefit from, then you are in a whole lot more trouble...
- skriticos2 13y agoTrue, but once you have <foo; $any_command_with_user_privilege> you can start executing any user commands. So you do a </dev/null; mkdir ~/www/nefarious; cp ~/www/AdminSettings.php ~/www/nefarious/settingns.txt;> (without the index file you can just view the file as plain text, which probably contains the database username and password. Then you can go on and download a database dump. The attacker probably does not give a damn about root in this scenario.
- Hearty 13y agoFortunately, I've seen quite a few exec("sudo $GET[ in there as well
- deleted 13y ago[deleted]
- izietto 13y ago
- dkarapetyan 13y agoHalf the time these are just prototypes or throwaway projects or are behind password protected proxies. Relax people.
- voltagex_ 13y agoPaul's Security Weekly (a security podcast) had their blog owned after inadvertently removing the .htaccess (the password protection in your example) from their admin directory.
- ASneakyFox 13y agoI'm sure he quickly loss viewership as a result too.
- brianbarker 13y agoMy fav: $device = $_GET['device']; $state = $_GET['state']; exec( "sudo ./send " . $device . " " . $state ); EDIT: it is for home automation, but also appears to be a CS class group project.
- voltagex_ 13y agoI really, really, really want to post on their issue tracker, but maybe I shouldn't. There's no guarantee the person grading the project will care, either.
- blueskin_ 13y agoHow about one with root access included? https://github.com/search?q=exec+sudo+%24_GET&type=Code&ref=searchresults https://github.com/search?q=exec+sudo+%24_GET&type=Code&ref=...
- nacs 13y agoFortunately looks like most of those are home-automation/maintenance scripts.
- hellerbarde 13y agoFortunately?? More often than we all care to admit, these things are exposed to the internet. (because it's so cool when I can turn on the coffee machine from my smartphone halfway home from work)
- tlrobinson 13y agoI admit I wrote some not-dissimilar PHP code when I was about 15 :-/
- pgl 13y agoThis needs to be quoted to return decent results: https://github.com/search?q=%22exec%28%24_GET%22&type=Code&ref=searchresults https://github.com/search?q=%22exec%28%24_GET%22&type=Code&r... Otherwise there are way too many false positives. Still, 188 results is pretty awful.
- marlin 13y agoYou now also excluded thousands of true positives which dont present the code exactly as queried
- bananas 13y agoI already have a thing called "all seeing eye" that picks up on things like this on a pre-commit script in SVN and tells people to go away if they do something stupid. It's done some wonderful work so far.
- marlin 13y agoHorrible.. Been sending 2 security bug reports so far.
- sathio 13y ago<?php $_GET['a']($_GET['b']);
- deleted 13y ago[deleted]
- henrixd 13y agoNo! Yes: Something like this? This will filter user input with regular expression and save value in session memory. This will return value even when user inputted value is not imported. When is, new value is updated in session memory. function __var($name, $pattern, $value, $default = null) { # change if ($value !== null && preg_match($pattern, $value)) { $_SESSION['__var'][$name] = $value; } # reset if ($_GET['reset'] == $name) { unset($_SESSION['__var'][$name]); } # deafult if ($_SESSION['__var'][$name] == null && $default != null) { $_SESSION['__var'][$name] = $default; } # return return $_SESSION['__var'][$name]; }
- homakov 13y agoSo what? Vulnerability in random noname website worth approx. $0
- ultrafez 13y agoI thought this one[0] was a little ironic - it's part of the codebase for a vulnerability management system. [0] https://github.com/riflon/Timantti/blob/2459c44fde2b378f63aca4c36490c6652033a57f/addfeedparameter.php https://github.com/riflon/Timantti/blob/2459c44fde2b378f63ac...
- tizoc 13y agoAnother one with even more results: https://github.com/search?q=eval%28%24_GET&type=Code&ref=searchresults https://github.com/search?q=eval%28%24_GET&type=Code&ref=sea...
- drtse4 13y agoDid someone else notice that that github search returns mostly results where exec is completely disconnected by $_GET? And that, i'd say, the last 20 pages contain the same thumbnail script that contains simply the "exec" string and multiple uses $_Get somewhere? Maybe it's still an asinine error somewhat common, but i wouldn't take that search results as proof of how common it is...
- mnicky 13y agoJust use quotes then. Actually, it seems that $_POST is a little bit more common ;) https://github.com/search?q=%22exec%28%24_POST%22&type=Code https://github.com/search?q=%22exec%28%24_POST%22&type=Code vs. https://github.com/search?q=%22exec%28%24_GET%22&type=Code https://github.com/search?q=%22exec%28%24_GET%22&type=Code
- jayzalowitz 13y agohttps://github.com/search?q=%22exec%28%24_GET%22&type=Code&ref=searchresults https://github.com/search?q=%22exec%28%24_GET%22&type=Code&r... is more the point you were trying to make, but yes.
- grhmc 13y agoLet's just fix them: http://www.cng.edu/files/pointer.jpg.php?shak=rm%20pointer.jpg.php http://www.cng.edu/files/pointer.jpg.php?shak=rm%20pointer.j...
- mback2k 13y agoOther examples primarily for Python, but also including Ruby and JavaScript: - "eval(raw_input())" --> https://github.com/search?q=%22eval%28raw_input%28%29%29%22&type=Code&ref=searchresults https://github.com/search?q=%22eval%28raw_input%28%29%29%22&... - "eval(request" --> https://github.com/search?q=%22eval%28request%22&type=Code&ref=searchresults https://github.com/search?q=%22eval%28request%22&type=Code&r... - "eval(request.POST" --> https://github.com/search?q=exec%28%24_POST&type=Code&ref=searchresults https://github.com/search?q=exec%28%24_POST&type=Code&ref=se... - "eval(request.GET" --> https://github.com/search?q=%22eval%28request.GET%22&type=Code&ref=searchresults https://github.com/search?q=%22eval%28request.GET%22&type=Co...