Remote Code Execution is more common than people think, RCE is unzanitized user input that is executed in a command line.
PHP Code:
<?php
if(isset($_POST['ip']))
echo "<pre>".shell_exec("ping ".$_POST['ip'])."</pre>";
?>
<html>
<form action="" method="post">
Ping <input type="text" name="ip"><input type=""submit" value="Submit!">
</form>
</html>
This will return:
Pinging google.com
[74.125.224.35] Reply from 74.125.224.35: bytes=32
Reply from 74.125.224.35: bytes=32
Reply from 74.125.224.35: bytes=32
Reply from 74.125.224.35: bytes=32
Reply from 74.125.224.35: bytes=32
Now, this is exactly what we‟d expect. However, if you are at all familiar with command line, you can pass parameters and other commands into it. For example, if : 127.0.0.1 -n 1 && dir
The “-n 1“ signifies that it will only ping once. This way, you don‟t have to wait for all 4 pings.
