(self)
| 24 | uses_interactsh = True |
| 25 | |
| 26 | async def fuzz(self): |
| 27 | cookies = self.event.data.get( |
| 28 | "assigned_cookies", {} |
| 29 | ) # Retrieve assigned cookies from WEB_PARAMETER event data, if present |
| 30 | probe_value = self.incoming_probe_value() |
| 31 | |
| 32 | canary = self.lightfuzz.helpers.rand_string(10, numeric_only=True) |
| 33 | http_compare = self.compare_baseline( |
| 34 | self.event.data["type"], probe_value, cookies |
| 35 | ) # Initialize the http_compare object and establish a baseline HTTP response |
| 36 | |
| 37 | cmdi_probe_strings = [ |
| 38 | "AAAA", # False positive probe |
| 39 | ";", |
| 40 | "&&", |
| 41 | "||", |
| 42 | "&", |
| 43 | "|", |
| 44 | ] |
| 45 | |
| 46 | positive_detections = [] |
| 47 | for p in cmdi_probe_strings: |
| 48 | try: |
| 49 | # add "echo" to the cmdi probe value to construct the command to be executed |
| 50 | echo_probe = f"{probe_value}{p} echo {canary} {p}" |
| 51 | # we have to handle our own URL-encoding here, because our payloads include the & character |
| 52 | if self.event.data["type"] == "GETPARAM": |
| 53 | echo_probe = urllib.parse.quote(echo_probe.encode(), safe="") |
| 54 | |
| 55 | # send cmdi probe and compare with baseline response |
| 56 | cmdi_probe = await self.compare_probe( |
| 57 | http_compare, self.event.data["type"], echo_probe, cookies, skip_urlencoding=True |
| 58 | ) |
| 59 | |
| 60 | # ensure we received an HTTP response |
| 61 | if cmdi_probe[3]: |
| 62 | # check if the canary is in the response and the word "echo" is NOT in the response text, ruling out mere reflection of the entire probe value without execution |
| 63 | if canary in cmdi_probe[3].text and "echo" not in cmdi_probe[3].text: |
| 64 | self.debug(f"canary [{canary}] found in response when sending probe [{p}]") |
| 65 | if p == "AAAA": # Handle detection false positive probe |
| 66 | self.warning( |
| 67 | f"False Postive Probe appears to have been triggered for {self.event.data['url']}, aborting remaining detection" |
| 68 | ) |
| 69 | return |
| 70 | positive_detections.append(p) # Add detected probes to positive detections |
| 71 | except HttpCompareError as e: |
| 72 | self.debug(e) |
| 73 | continue |
| 74 | if len(positive_detections) > 0: |
| 75 | self.results.append( |
| 76 | { |
| 77 | "type": "FINDING", |
| 78 | "description": f"POSSIBLE OS Command Injection. {self.metadata()} Detection Method: [echo canary] CMD Probe Delimeters: [{' '.join(positive_detections)}]", |
| 79 | } |
| 80 | ) |
| 81 | |
| 82 | # Blind OS Command Injection |
| 83 | if self.lightfuzz.interactsh_instance: |
nothing calls this directly
no test coverage detected