Hướng Dẫn Thực Hành - Command Execution Basic Testing (DVWA): Lesson 2

{ Command Execution Basic Testing }

---

Section 0. Background Information

• What is Damn Vulnerable Web App (DVWA)?
  • Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable.
  • Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
• Pre-Requisite Lab
  • Damn Vulnerable Web App (DVWA): Lesson 1: How to Install DVWA in Fedora 14 (hoặc chạy trên máy ảo DVWA do instructor cung cấp)
• Lab Notes
  • In this lab we will do the following:
    1. We will test Command Execution where Security is set to low
    2. We will demonstrate how other linux/unix commands can be appended to an IP Address for execution.
    3. We will explorer the code that allows for malicious use.

• Legal Disclaimer : Bài lab chỉ dùng cho mục đích học tập, nghiên cứu về bảo mật. 

Section 1. Configure Fedora14 Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit BackTrack Virtual Machine Settings
   • Instructions:
     1. Highlight fedora14
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
• Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Click on the OK Button.
• 

Section 2. Login to Fedora14

1. Start Fedora14 VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select Fedora14
     3. Play virtual machine
   • 
2. Login to Fedora14
   • Instructions:
     1. Login: student
     2. Password: <whatever you set it to>.
   • 

Section 3. Open Console Terminal and Retrieve IP Address

1. Start a Terminal Console
   • Instructions:
     1. Applications --> Terminal
   • 
2. Switch user to root
   • Instructions:
     1. su - root
     2. <Whatever you set the root password to>
   • 
3. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • As indicated below, my IP address is 192.168.1.106.
     • Please record your IP address.
   • 

Section 4. Disable SELINUX

1. Start a Terminal Console
   • Instructions:
     1. sestatus
     2. If SELinux status: is set to disabled OR if Current mode: is set to permissive, then skip the next steps, and Continue to the Next Section.
     3. If SELinux status: is set to enabled AND if Current mode: is set to enforcing, then Continue the next steps.
   • Notes:
     • In my case, I need to temporarily put selinux in permissive mode to demonstrate basic attacks on DVWA.
   • 
2. Start a Terminal Console
   • Instructions:
     1. echo 0 > /selinux/enforce
        • Placing a "0" in the enforce file, puts selinux in permissive mode.
     2. sestatus
        • Notice that "Current mode:" changed to permissive.
   • 

Section 5. Start Up Damn Vulnerable Web App (DVWA)

1. Start up a Web Browser  
   • Instructions:
     1. Applications --> Internet --> Firefox
   • Notes:
     • You can open up a Web browser on any Operating System on your network.
     • Working with DVWA does not have to be done on your Fedora machine, the only requirement to play with DVWA is a follow
       1. The Fedora Server is on the Network.
       2. httpd is running
       3. mysqld is running
   • 
2. DVWA Database setup  
   • Instructions:
     1. http://192.168.1.106/dvwa/login.php
        • Replace 192.168.1.106 with the IP Address obtained from Section 3, Step 3.
     2. Username: admin
     3. Password: password
        • "password" is the default password for user admin.
   • 
3. Set Website Security Level (Part 1) 
   • Instructions:
     1. Click on DVWA Security
   • 
4. Set Website Security Level (Part 2) 
   • Instructions:
     1. Select Low
     2. Click Submit
   • 

Section 6. Command Execution

1. Command Execution  
   • Instructions:
     1. Click on Command Execution
   • 
2. Execute Ping  
   • Notes:
     • Below we are going to do a simply ping test using the web interface.
     • As an example, ping something on your network.
     • Use the IP Address obtained in Section 3, Step 3 if you have nothing else to ping.
   • Instructions:
     1. 192.168.1.106
     2. Click Submit
   • 
3. cat /etc/password (Attempt 1)  
   • Instructions:
     1. cat /etc/passwd
     2. Click Submit
   • Notes:
   • Notice that either a messaging saying illegal IP address was displayed or nothing was returned.
   • 
4. cat /etc/password (Attempt 2)  
   • Instructions:
     1. 192.168.1.106; cat /etc/passwd
     2. Click Submit
   • Notes:
   • Notice that we are now able to see the contents of the /etc/passwd file.
   • 
5. Looking at the weakness  
   • Instructions:
     1. Bring up a terminal window (See Section 3, Step 1, if you don't know how)
     2. cat /var/www/html/dvwa/vulnerabilities/exec/source/low.php
   • Notes:
     1. Notice the two shell_exec lines.
     2. These are the lines that execute ping depending on which Operating System is being used.
     3. In Unix/Linux command, you can run multiple command separated by a ";".
     4. Notice the code does not check that if $target matches an IP Address
        • \d+.\d+.\d+.\d+, where "\d+" represents a number with the possibility of multiple digits, like 192.168.1.106.
     5. The code allows for an attacker to append commands behind the IP Address.
        1. 192.168.1.106; cat /etc/passwd
   • 
6. Copy the /etc/passwd file to /tmp
   • Instructions:
     1. 192.168.1.106; cat /etc/passwd | tee /tmp/passwd
   • Note:
     • Here we are not only displaying the contents of /etc/passwd on the webpage, but also we are copying the /etc/passwd file to the /tmp directory.
   • 

Section 7. Proof of Lab

1. Proof of Lab
   • Instructions:
     1. Bring up a terminal windows
     2. cd /tmp
     3. ls -l passwd
     4. date
     5. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "An Toàn Thông Tin"
   • Proof of Lab Instructions:
     1. Do a <PrtScn>
     2. Paste into a word document
     3. Email to AnToanThongTin.Edu.VN@Gmail.Com
   •