DVWA Lesson 2: Command execution (Low)

Good ol’ command execution

First Lesson: DVWA Lesson 1: Installing on Windows.

Now we have everything set up on our Windows machine, we can finally begin we some fun! Login in with the password set during the previous lesson, and head towards the ‘DVWA Security’ tab on the bottom left hand side. Continue by setting the ‘Script Security’ level to ‘Low’, and clicking ‘submit’.

If you’ve installed DVWA on Windows or Linux, keep in mind which when executing commands!

Head over towards the ‘Command Execution’ tab:

  • Try entering ‘192.168.1.1’, what happens?
  • Are you able to execute any other commands?
  • No? Time to read the source, located at: DVWA-1.0.8/vulnerabilities/exec/source/low.php
<?php

if( isset( $_POST[ 'submit' ] ) ) {

$target = $_REQUEST[ 'ip' ];

// Determine OS and execute the ping command.
if (stristr(php_uname('s'), 'Windows NT')) {

$cmd = shell_exec( 'ping ' . $target );
$html .= '<pre>'.$cmd.'</pre>';

} else {

$cmd = shell_exec( 'ping -c 3 ' . $target );
$html .= '<pre>'.$cmd.'</pre>';

}

?>

As we can see, the $target variable contains our user input. Fortunately for us it’s not being sanitized when passed to the shell_exec function. Allowing for our commands to cause malicious behaviour. As we’re hosting DVWA on a Windows Operating System we’re able to run commands consecutively by using ‘&’ in-between each one.

Try out the commands bellow, or your own, if you feel confident in a Windows Terminal environment.

Examples

  • “127.0.0.1 & tasklist” – List the hosts current processes
  • “127.0.0.1 & netstat -a”- Gives us the current ports opened on the host

Further reading

Read More
Via.Vision Via.Vision August 21, 2015 0 Comments

DVWA Lesson 1: Installing on Windows

Damn vulnerable what?!

DVWA (Damn Vulnerable Web App) was made by security professionals, for researchers and enthusiasts to practice and learn different types of vulnerabilities in relation to web applications which can also be used for other things such as software activation keys. Before continuing it must be stressed that the testing of DVWA should be done on an isolated host with either VMware or Virtual Box, separated by a Host-only connection. This is for your safety, not doing so could lead to the compromise of your system. You can store the files on an external hard drive or a USB drive. You can purchase USB drives online from Amazon.

Software:

Further reading:

WARNING: THIS IS FOR EDUCATIONAL PURPOSES ONLY!

  • Firstly install Xampp for windows. Then continue on by opening up the Xampp Control Panel, either placed on your desktop, Program files or already started on the bottom left of the screen. Lastly, start your MySQL and Apache services.
  • Extract the dvwa folder to this location C:\xampp\htdocs\dvwa. We now open our webrowser and enter ‘localhost/dvwa’ (127.0.0.1/dvwa) into the url bar. If we are presented with a mysql.error() that means the database was unable to be created, but easily fixed in step 3.
  • Go on over to C:\xampp\htdocs\dvwa\config\config.inc.php and use your favourite editor to open the file, scroll down to line 20. We now enter the default PHPMyAdmin, in the db_password field, replacing the current one with nothing. Leaving it empty (no spaces)
  • Jump to your browser and go to 127.0.0.1/dvwa/setup.php, and click ‘create Database’ Then go to localhost/dvwa/login.php and enter your user name ‘admin’ and password ‘password’.

Next LessonDVWA Lesson 2: Command execution Low

Read More
Via.Vision Via.Vision August 21, 2015 0 Comments