SC 202: Shell Code Injection (25 pts)

What You Need

Making an HTML Form

On your cloud Linux server, execute this command: 
sudo nano /var/www/html/SC202.htm
Paste in this code, as shown below. 
<html>
<body>
<form action="SC202.php">
    IP: <input name="ip"><p>
    <input type="submit" value="Ping">
</form>
</body>
</html>
Save the file with Ctrl+X, Y, Enter.

Making a PHP Script

On your cloud Linux server, execute this command: 
sudo nano /var/www/html/SC202.php
Paste in this code, as shown below. 
<?php

if (!isset($_REQUEST['ip'])) {
	die("<h2>Error: No ip specified!</h2>");
}

$ip = $_REQUEST['ip'];
$cmd = "ping -c 2 $ip 2>&1"; 
system($cmd);

?>
(Note: the "2>&1" redirects stderr to stdout, so we can see error messages.)

Save the file with Ctrl+X, Y, Enter.

Testing your Form

In a Web browser, open this URL, replacing the IP address with the external IP of your server:
http://35.222.29.122/SC202.htm
Enter 1.1.1.1 into the form, as shown below, and click the Ping button.

The next page shows the ping results, as shown below.

In a Web browser, open this page:
https://samlols.samsclass.info/SC/SC202.htm
Enter the URL to your PHP page in the form for flag SC 202.1, as shown below, and click the Submit button.

Flag SC 202.1: Ping (5 pts)

The flag appears, as shown below.

Observing the Code Injection Vulnerability

In a Web browser, open this URL, replacing the IP address with the external IP of your server:
http://35.222.29.122/SC202.htm
Enter this IP into the form:
1.1.1.1;whoami
as shown below, and click the Submit button.

The next page shows "www-data" after the pings, as shown below.

This is the name of the Apache user.

This demonstrates a code injection vulnerability--the user's input can contain shell commands that are executed.

Fix 1: Removing Characters

Modify your script to remove these characters from the ip:
; |
I recommend using the str_replace function. Test your script on your own HTML form.

When it's working, run the test in the box below to get the flag.

Flag SC 202.2: Removing Bad Characters (10 pts)

In a Web browser, open this page:

https://samlols.samsclass.info/SC/SC202.htm
Enter the URL to your PHP page in the form for flag SC 202.2 and submit the form. If your code is correct, the flag will appear.

Fix 2: Allowing Only Good Characters

Modify your script to allow only numbers and dots in the IP address. It should accept inputs with other characters, but remove them.

When it's working, run the test in the box below to get the flag.

Hint: Use preg_replace

Flag SC 202.3: Allowing Only Good Characters (10 pts)

In a Web browser, open this page:

https://samlols.samsclass.info/SC/SC202.htm
Enter the URL to your PHP page in the form for flag SC 202.3 and submit the form. If your code is correct, the flag will appear.

Posted 3-28-24
preg_replace hint added 7-18-24