黑客攻击网络服务器
您好，我的任务是尝试破坏我公司使用的专有网络服务器程序，但我的运气不太好。它是用c构建的。
它以 root 身份运行，我试图让它执行命令。 Web 服务器接受 URL 中发布的命令并使用前缀执行这些命令。现在我可以传递任何命令，例如“&_cmd=gettimeout”或“&_cmd=rm”。该程序实际上将运行“prefix rm”。
前缀程序将尝试在一组目录中运行该命令，其中没有有用的unix命令，因此只会报告未找到命令。也不可能在 URL 中传递空格，例如“&_cmd=rm%20-f”，因为 php 脚本会将空格转换为 +。是否有格式化 &_cmd 字符串来运行真正的 unix 命令？
这是一项有点奇怪的任务，但我是一名正在学习安全课程的实习学生，我的工作是试图为我找到一些与我的课程相关的工作。
感谢您的帮助
Hi I have been tasked with trying to break a proprietary web server program which my company uses, I'm not really having much luck. It is built in c.
It runs as root and I am trying to get it to execute commands. The webserver takes commands posted in the URL and executes these commands with a prefix. Now I can pass any command such as '&_cmd=gettimeout' or '&_cmd=rm'. The program will actually run "prefix rm"
The prefix program will try to run that command in a set of directories, of which no useful unix commands are, therefore will just report back command not found. It is also not possible to pass spaces in the URL such as '&_cmd=rm%20-f' as the php script converts spaces to +. Is there anyway of formatting the &_cmd string to run real unix commands?
Bit of a strange task but I am a placement student doing a security course and my work are attempting to find some work for me regarding my course.
Thanks for your help
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
有些想法可能有效，也可能无效：
prefix运行之前进行评估。运气不好的话，他们可能仍然会以某种方式为你服务。vi，你无论如何也不能做任何你不能做的事情）。但在这种情况下，您也许可以利用它们。/proc/中找到可执行文件 - 它包含指向每个进程命令的链接。Some ideas, might work, might not:
prefixruns. Without luck, they might still serve you somehow.vi, you can't do anything you couldn't do anyway). But in this context, you may be able to exploit them./proc/, if you can get there - it contains a link to each processes's command.