批量利用未正确转义的字符串
在 Windows 软件 X 中，您制定的每个链接都会自动转换为可点击的对象。
这里有趣且与安全相关的部分是，像“http://%COMPUTERNAME%.com/”这样的链接将打开标准浏览器，调用“http://NR57005-PC.com/”，这当然是由于所有环境变量都被转换，因此存在信息泄露漏洞。
现在我的问题是，这种行为是否会导致更严重的问题 - 例如代码执行漏洞，这将大大增加快速修复的重要性。
您对如何证明这不仅是一个披露问题而且是一个严重漏洞有什么建议吗？攻击者是否有可能注入批处理命令？
我已经尝试过管道、& 符号和引号，但到目前为止我还没有发现任何有趣的东西。
提前致谢，
帕特里克
编辑： 为了澄清，我的方法如下： 系统必须正在执行类似 firefox.exe "http://%COMPUTERNAME%.com/" 的命令，否则系统变量将不会被转换。 现在，因为我知道正在进行一些未经过滤的批处理调用，所以我认为可以转义参数字符串。例如，像 http://google.com/"¬epad&" 这样的链接可能会生成 firefox.exe "http//google.exe"。 com"¬epad&""，这将打开记事本 - 作为代码执行工作的概念证明。不幸的是，这次逃跑尝试并没有成功。因此我想知道是否还有其他技巧来获得 shell 访问权限或类似的。
In Windows software X every link you formulate is automatically converted into a clickable object.
The interesting and security-relevant part here is, that a link like "http://%COMPUTERNAME%.com/" will open the standard browser calling e.g. "http://NR57005-PC.com/", which of course is an information disclosure vulnerability, as all environment variables are converted.
Now my question is, whether this behaviour could lead to more critical issues - e.g. code execution vulnerabilities, which would highly increase the importance of a quick fix.
Do you have any suggestions how to prove, that this this is not only a disclosure issue but a critical vulnerability? Could an attacker inject batch commands by any chance?
I already played around with pipes, ampersands and quotes but so far I didn't find anything interesting.
Thanks in advance,
Patrick
Edit:
To clarify, my approach was the following:
The system must be executing a command like firefox.exe "http://%COMPUTERNAME%.com/", otherwise the system variable would not be converted.
And now, for I know that there is some unfiltered batch call going on, I thought it could be possible to escape the parameter string. For instance, a link like http://google.com/"¬epad&" could have resulted in firefox.exe "http//google.com"¬epad&"", which would have opened the notepad - as a proof of concept that code execution works. Unfortunately this escaping attempt did not work. Therefore I wonder, if there are other tricks to gain shell access or similar.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您的攻击者必须注册并控制服务器
NR57005-PC.com。为此，他必须事先掌握有关主机名的信息。呈现的攻击面将取决于用于检索链接的用户代理，这将取决于您的批处理文件处理和/或系统上配置的默认浏览器。
假设使用 Internet Explorer，您的攻击面将比您预期的批处理文件有所减少，因为网站将不再位于
本地计算机区域，而是位于Internet 区域。像您正在考虑的狡猾技巧是行不通的。您只能使用典型的 IE 漏洞来获得控制权。批处理文件为您提供了机会，而无需依赖用户来访问恶意网站。
我假设您是笔测试员/审计员，并且正在尝试验证结果。我建议
1 - 编写一个演示，但根据用户错误来运行可执行文件或类似文件。您可以声称用户不希望浏览器提供 exe，因此会更加信任，即使他不应该这样做。
2 - 认识到这不是一个严重漏洞并继续前进。攻击者可以通过精心设计的社会工程电子邮件更轻松地获得相同的访问/信任。
Your attacker would have to register and control the server
NR57005-PC.com. To do so, he would have to have prior information about the hostname(s).The attack surface presented will depend on the User Agent used to retrieve the link, which will depend on your batch file processing and/or the default browser configured on the system.
Assuming Internet Explorer, your attack surface will be reduced from what you may expect thinking about it as a batch file, because the website will no longer be in the
Local Computerzone, but theInternet Zone.Crafty tricks like you're considering won't work.You're left with using a typical IE vulnerability to gain control. The batch file gains you the opportunity, without depending on a user to visit a malicious website.
I assume you're a pen-tester/auditor and are trying to qualify a finding. I'd recommend
1 - hacking together a demo, but depending on user error to run an executable or similar. You can make the claim a user isn't expecting the browser to give an exe, and thus will be more trusting, even though he should not be.
2 - Recognize the fact it's not a critical vulnerability and move on. An attacker can get the same access/trust more easily through a well-crafted social engineering email.