library/src/exploitation/WebExploitation/CommandExecution/BP-WebExploitationCommandExecution.cc
// This will execute a command on a given shell, and try to return the relevant data.
This will execute a command on a given shell, and try to return the relevant data.
This will execute a command on a given shell and try to return the relevant data .
P_BP_COMMAND_INJECTION_EXECUTION_RESULT BP_CommandInjectionExecuteCommandOnShell
(
		P_BP_WEB_COMMAND_INJECTION_TEST_SESSION cmd_injection_session,
		char *                                  execute_command,
		P_BP_WEB_COMMAND_INJECTION_TEST         vulnerable_element,
		BP_BOOL                                 prefer_reflective
)
{
	if(!cmd_injection_session)
		return NULL;
	if(!vulnerable_element)
		return NULL;
	if(!execute_command)
		return NULL;
	if(!BP_StringIsReasonablePrintableString(execute_command, bpstrlen(execute_command), BP_FALSE, BP_FALSE))
		return NULL;
	if(vulnerable_element->pattern_reflection_tests_found_vulnerable_n)
	{
		char * joiner[30];
		BP_ZERO_STACK(joiner);
		size_t test_index = vulnerable_element->pattern_reflection_tests_found_vulnerable[0];
		P_BP_WEB_COMMAND_INJECTION_ELEMENT test = &cmd_injection_session->test_elements[0];
		 inde
		P_BP_WEB_COMMAND_INJECTION_PATTERN_REFLECTION_TEST reflect_test = &test->pattern_reflection_tests[test_index];
		size_t joiner_idx = 0;
		if(reflect_test->front_part)
		{
			joiner[joiner_idx] = reflect_test->front_part;
			joiner_idx++;
		}
		joiner[joiner_idx] = execute_command;
		joiner_idx++;
		if(reflect_test->back_part)
		{
			joiner[joiner_idx] = reflect_test->back_part;
			joiner_idx++;
		}
		char *joined = BP_JoinStringArray(joiner, joiner_idx);
		printf("\n Got Joined String: %s", joined);
		bpfree(joined);
		char *url_encoded = BP_UTF8StringEncode(joined, bpstrlen(joined));
		printf("\n Encoded: %s", url_encoded);
		if(vulnerable_element->is_form_test)
		{
		}
	}
}
P_BP_COMMAND_INJECTION_EXECUTION_RESULT BP_CommandInjectionExecuteCommandOnShell ( P_BP_WEB_COMMAND_INJECTION_TEST_SESSION cmd_injection_session , char * execute_command , P_BP_WEB_COMMAND_INJECTION_TEST vulnerable_element , BP_BOOL prefer_reflective ) { if ( ! cmd_injection_session ) return NULL ; if ( ! vulnerable_element ) return NULL ; if ( ! execute_command ) return NULL ; if ( ! BP_StringIsReasonablePrintableString ( execute_command , bpstrlen ( execute_command ) , BP_FALSE , BP_FALSE ) ) return NULL ; if ( vulnerable_element -> pattern_reflection_tests_found_vulnerable_n ) { char * joiner [ 30 ] ; BP_ZERO_STACK ( joiner ) ; size_t test_index = vulnerable_element -> pattern_reflection_tests_found_vulnerable [ 0 ] ; P_BP_WEB_COMMAND_INJECTION_ELEMENT test = & cmd_injection_session -> test_elements [ 0 ] ; P_BP_WEB_COMMAND_INJECTION_PATTERN_REFLECTION_TEST reflect_test = & test -> pattern_reflection_tests [ test_index ] ; size_t joiner_idx = 0 ; if ( reflect_test -> front_part ) { joiner [ joiner_idx ] = reflect_test -> front_part ; joiner_idx ++ ; } joiner [ joiner_idx ] = execute_command ; joiner_idx ++ ; if ( reflect_test -> back_part ) { joiner [ joiner_idx ] = reflect_test -> back_part ; joiner_idx ++ ; } char * joined = BP_JoinStringArray ( joiner , joiner_idx ) ; printf ( " \n " , joined ) ; bpfree ( joined ) ; char * url_encoded = BP_UTF8StringEncode ( joined , bpstrlen ( joined ) ) ; printf ( " \n " , url_encoded ) ; if ( vulnerable_element -> is_form_test ) { } } }
This will execute a command on a given shell, and try to return the relevant data.
This will execute a command on a given shell and try to return the relevant data .
// ensure string is reasonable // calculate test index // set the test // set the test inde // incrementing joiner idx // add front part if we have one // add back part if we have one // display joined string // set url encoded // BP_HTTPRequest(cmd_injection_session->html_extraction_reference->http_session_reference, )