library/src/exploitation/WebExploitation/CommandExecution/BP-WebExploitationCommandExecution.cc
// runs command injection tests (actually makes requests)
runs command injection tests (actually makes requests)
runs command injection tests ( actually makes requests )
BP_ERROR_T BP_CommandInjectionRunHTTPRequests
(
		P_BP_WEB_COMMAND_INJECTION_TEST_SESSION cmd_injection_session,
		P_BP_HTTP_SESSION http_session,
		P_BP_WEB_COMMAND_INJECTION_TEST test,
		P_BP_WEB_COMMAND_INJECTION_HTTP_REQUEST_INFO http_generated_requests
)
{
	if(!cmd_injection_session)
		return ERR_FAILURE;
	if(!test)
		return ERR_FAILURE;
	if(!http_generated_requests)
		return ERR_FAILURE;
	if(!http_session)
		return ERR_FAILURE;
	size_t request_iter = 0;
	P_BP_WEB_COMMAND_INJECTION_HTTP_REQUEST request = NULL;
	for
	(
			;
			request_iter < http_generated_requests->request_n;
			request_iter++
	)
	{
		request = &http_generated_requests->generated_requests[request_iter];
		BP_CommandInjectionLockAssessment(cmd_injection_session);
		cmd_injection_session->all_requests = (P_BP_WEB_COMMAND_INJECTION_HTTP_REQUEST *) tq_realloc
		(
				cmd_injection_session->tq,
				cmd_injection_session->all_requests,
				sizeof(P_BP_WEB_COMMAND_INJECTION_HTTP_REQUEST *) * (cmd_injection_session->request_n+1),
				BPLN
		);
		cmd_injection_session->all_requests[cmd_injection_session->request_n] = request;
		cmd_injection_session->request_n++;
		BP_CommandInjectionUnlockAssessment(cmd_injection_session);
		if(request->post_str)
			BP_HTTPSetPostVars(http_session, request->post_str);
		if(request->cookie_str)
			BP_HTTPSetCookie(http_session, request->cookie_str);
		size_t retry_iter = 0;
		while(BP_HTTPRequest(http_session, request->get_str, BP_TRUE) == ERR_FAILURE)
		{
			if(retry_iter < http_session->max_request_retries)
			{
				retry_iter++;
				continue;
			}
			else
				break;
		}
		if(retry_iter < http_session->max_request_retries)
		{
			if(http_session->page->page_data)
			{
				if(request->pattern_reflection_test_ref)
				{
					if
					(
						memmem
						(
								http_session->page->page_data,
								http_session->page->page_data_size,
								request->pattern_reflection_test_ref->precomputed_test_result,
								bpstrlen(request->pattern_reflection_test_ref->precomputed_test_result)
						)
					)
					{
						 before operating on data
						BP_CommandInjectionLockAssessment(cmd_injection_session);
						cmd_injection_session->total_command_injection_points_discovered++;
						test->pattern_reflection_tests_found_vulnerable_n++;
						test->pattern_reflection_tests_found_vulnerable = (size_t *) tq_realloc
						(
								cmd_injection_session->tq,
								test->pattern_reflection_tests_found_vulnerable,
								sizeof(size_t) * test->pattern_reflection_tests_found_vulnerable_n,
								BPLN
						);
						test->pattern_reflection_tests_found_vulnerable[test->pattern_reflection_tests_found_vulnerable_n-1] = request->pattern_reflection_test_index;
						test->testing_reported_vulnerable_condition = BP_TRUE;
						 when finished
						BP_CommandInjectionUnlockAssessment(cmd_injection_session);
						request->is_pattern_reflection_vuln = BP_TRUE;
					}
				}
			}
			if(request->file_verification_test_ref)
			{
				char * joiner[3];
				BP_ZERO_STACK(joiner);
				char * tmp_path = BP_ParseURLToPathPCRE(request->get_str);
				if(!tmp_path)
					tmp_path = BP_ParseURLToBasePCRE(request->get_str);
				joiner[0] = tmp_path;
				joiner[1] = request->file_verification_test_ref->upload_file_name;
				char *uploaded_file = BP_JoinStringArray((char **) &joiner, 2);
				if(tmp_path)
					bpfree(tmp_path);
				retry_iter = 0;
				while
				(
					(BP_HTTPRequest(http_session, uploaded_file, BP_TRUE) == ERR_FAILURE) &&
					(retry_iter < http_session->max_request_retries)
				)
				{
						retry_iter++;
				}
				if(uploaded_file)
					bpfree(uploaded_file);
				if(http_session->http_status_code == 200)
				{
					if
					(
							memmem
							(
									http_session->page->page_data,
									http_session->page->page_data_size,
									request->file_verification_test_ref->upload_file_body,
									bpstrlen(request->file_verification_test_ref->upload_file_body)
							)
					)
					{
						 before operating on data
						BP_CommandInjectionLockAssessment(cmd_injection_session);
						cmd_injection_session->total_command_injection_points_discovered++;
						test->file_verification_tests_found_vulnerable_n++;
						test->file_verification_tests_found_vulnerable = (size_t *) tq_realloc
						(
								cmd_injection_session->tq,
								test->file_verification_tests_found_vulnerable,
								sizeof(size_t) * test->file_verification_tests_found_vulnerable_n,
								BPLN
						);
						test->file_verification_tests_found_vulnerable[test->file_verification_tests_found_vulnerable_n-1] = request->file_verification_test_index;
						test->testing_reported_vulnerable_condition = BP_TRUE;
						 when finished
						BP_CommandInjectionUnlockAssessment(cmd_injection_session);
						request->is_file_verification_vuln = BP_TRUE;
					}
				}
			}
			request->request_succeded = BP_TRUE;
		}
	}
	if(http_session->page->memPtr)
	{
		bpfree(http_session->page->memPtr);
		http_session->page->page_data_size = 0;
		http_session->page->memPtr = NULL;
	}
	return ERR_SUCCESS;
}
BP_ERROR_T BP_CommandInjectionRunHTTPRequests ( P_BP_WEB_COMMAND_INJECTION_TEST_SESSION cmd_injection_session , P_BP_HTTP_SESSION http_session , P_BP_WEB_COMMAND_INJECTION_TEST test , P_BP_WEB_COMMAND_INJECTION_HTTP_REQUEST_INFO http_generated_requests ) { if ( ! cmd_injection_session ) return ERR_FAILURE ; if ( ! test ) return ERR_FAILURE ; if ( ! http_generated_requests ) return ERR_FAILURE ; if ( ! http_session ) return ERR_FAILURE ; size_t request_iter = 0 ; P_BP_WEB_COMMAND_INJECTION_HTTP_REQUEST request = NULL ; for ( ; request_iter < http_generated_requests -> request_n ; request_iter ++ ) { request = & http_generated_requests -> generated_requests [ request_iter ] ; BP_CommandInjectionLockAssessment ( cmd_injection_session ) ; cmd_injection_session -> all_requests = ( P_BP_WEB_COMMAND_INJECTION_HTTP_REQUEST * ) tq_realloc ( cmd_injection_session -> tq , cmd_injection_session -> all_requests , sizeof ( P_BP_WEB_COMMAND_INJECTION_HTTP_REQUEST * ) * ( cmd_injection_session -> request_n + 1 ) , BPLN ) ; cmd_injection_session -> all_requests [ cmd_injection_session -> request_n ] = request ; cmd_injection_session -> request_n ++ ; BP_CommandInjectionUnlockAssessment ( cmd_injection_session ) ; if ( request -> post_str ) BP_HTTPSetPostVars ( http_session , request -> post_str ) ; if ( request -> cookie_str ) BP_HTTPSetCookie ( http_session , request -> cookie_str ) ; size_t retry_iter = 0 ; while ( BP_HTTPRequest ( http_session , request -> get_str , BP_TRUE ) == ERR_FAILURE ) { if ( retry_iter < http_session -> max_request_retries ) { retry_iter ++ ; continue ; } else break ; } if ( retry_iter < http_session -> max_request_retries ) { if ( http_session -> page -> page_data ) { if ( request -> pattern_reflection_test_ref ) { if ( memmem ( http_session -> page -> page_data , http_session -> page -> page_data_size , request -> pattern_reflection_test_ref -> precomputed_test_result , bpstrlen ( request -> pattern_reflection_test_ref -> precomputed_test_result ) ) ) { BP_CommandInjectionLockAssessment ( cmd_injection_session ) ; cmd_injection_session -> total_command_injection_points_discovered ++ ; test -> pattern_reflection_tests_found_vulnerable_n ++ ; test -> pattern_reflection_tests_found_vulnerable = ( size_t * ) tq_realloc ( cmd_injection_session -> tq , test -> pattern_reflection_tests_found_vulnerable , sizeof ( size_t ) * test -> pattern_reflection_tests_found_vulnerable_n , BPLN ) ; test -> pattern_reflection_tests_found_vulnerable [ test -> pattern_reflection_tests_found_vulnerable_n - 1 ] = request -> pattern_reflection_test_index ; test -> testing_reported_vulnerable_condition = BP_TRUE ; BP_CommandInjectionUnlockAssessment ( cmd_injection_session ) ; request -> is_pattern_reflection_vuln = BP_TRUE ; } } } if ( request -> file_verification_test_ref ) { char * joiner [ 3 ] ; BP_ZERO_STACK ( joiner ) ; char * tmp_path = BP_ParseURLToPathPCRE ( request -> get_str ) ; if ( ! tmp_path ) tmp_path = BP_ParseURLToBasePCRE ( request -> get_str ) ; joiner [ 0 ] = tmp_path ; joiner [ 1 ] = request -> file_verification_test_ref -> upload_file_name ; char * uploaded_file = BP_JoinStringArray ( ( char * * ) & joiner , 2 ) ; if ( tmp_path ) bpfree ( tmp_path ) ; retry_iter = 0 ; while ( ( BP_HTTPRequest ( http_session , uploaded_file , BP_TRUE ) == ERR_FAILURE ) && ( retry_iter < http_session -> max_request_retries ) ) { retry_iter ++ ; } if ( uploaded_file ) bpfree ( uploaded_file ) ; if ( http_session -> http_status_code == 200 ) { if ( memmem ( http_session -> page -> page_data , http_session -> page -> page_data_size , request -> file_verification_test_ref -> upload_file_body , bpstrlen ( request -> file_verification_test_ref -> upload_file_body ) ) ) { BP_CommandInjectionLockAssessment ( cmd_injection_session ) ; cmd_injection_session -> total_command_injection_points_discovered ++ ; test -> file_verification_tests_found_vulnerable_n ++ ; test -> file_verification_tests_found_vulnerable = ( size_t * ) tq_realloc ( cmd_injection_session -> tq , test -> file_verification_tests_found_vulnerable , sizeof ( size_t ) * test -> file_verification_tests_found_vulnerable_n , BPLN ) ; test -> file_verification_tests_found_vulnerable [ test -> file_verification_tests_found_vulnerable_n - 1 ] = request -> file_verification_test_index ; test -> testing_reported_vulnerable_condition = BP_TRUE ; BP_CommandInjectionUnlockAssessment ( cmd_injection_session ) ; request -> is_file_verification_vuln = BP_TRUE ; } } } request -> request_succeded = BP_TRUE ; } } if ( http_session -> page -> memPtr ) { bpfree ( http_session -> page -> memPtr ) ; http_session -> page -> page_data_size = 0 ; http_session -> page -> memPtr = NULL ; } return ERR_SUCCESS ; }
runs command injection tests (actually makes requests)
runs command injection tests ( actually makes requests )
// ensure we have a session // ensure we have a test // ensure we have request to run // ensure we have a http session // request iter // reference into the request stack // set request // lock the assessment // allocate space for the entry // set the request // increment the request counter // unlock the assessment // set the post string if there is one // set cookie if there is one // counter for matching retries // try to make request // check request retries // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Run Pattern Reflection Check %%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Match Text %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // search for pattern // lock the assessment before operating on data // increase the number of vuln points // increment the number of reflection conditions found // allocate space for the vulnerable test indicators // set the test indicators here // set vulnerable condition flag if set // unlock the assessment when finished // mark as pattern reflection // printf("\n EUREKA!: %s\n\n", http_session->page->page_data); // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Now Run File Verification Tests %%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // if we have an associated file verification test, run it // create joiner // if we cant get path, it's a base url // create the uploaded file // reset the request iter for use here // printf("\n Uploaded File?: %s", uploaded_file); // try to make request // now examine the file to see that our data was written // lock the assessment before operating on data // increase the number of vuln points // increment the number of reflection conditions found // allocate space for the vulnerable test indicators // set the test indicators here // set vulnerable condition flag if set // unlock the assessment when finished // mark the request as vulnerable