02 / SOURCE CODE REVIEW
White-Box Testing: OS Command Injection
Reviewed the DNS Lookup Utility source code with full visibility and identified an unauthenticated OS command injection vulnerability caused by unsanitized input reaching shell_exec().
Lab environment
EH vulnerable machine, Ubuntu 24.04 Attackbox, VirtualBox Host-only network.
Assessment highlights
- The form submits a user-controlled command parameter to script.php.
- The backend concatenates the parameter directly into shell_exec("nslookup $command").
- Shell metacharacters can therefore be interpreted as commands rather than treated as domain-name data.
- The application also lacks authentication/authorization checks and output encoding.
Security impact
An attacker can execute operating-system commands with the privileges of the web-server process. The report identifies potential information disclosure, further compromise and lateral movement.
Recommendations
- Replace shell execution with PHP native DNS functions such as dns_get_record() or checkdnsrr().
- If a shell call is unavoidable, apply strict allowlisting and use escapeshellarg() as defense-in-depth.
- Run the web service with least privilege.
- HTML-escape command output before rendering it.
Lab scope: This case study describes coursework performed against intentionally vulnerable systems in an isolated environment.