Skip to content

Instantly share code, notes, and snippets.

@stasinopoulos

stasinopoulos/ping.aspx

Created April 14, 2017 13:14
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save stasinopoulos/95ce3d164fec1d477f80ea3675be2021 to your computer and use it in GitHub Desktop.
Save stasinopoulos/95ce3d164fec1d477f80ea3675be2021 to your computer and use it in GitHub Desktop.
Download ZIP
Simple ASPX application (vulnerable to OS command injections)
Raw
ping.aspx
<%@ Page Language="C#" Debug="true" Trace="false" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
<script Language="c#" runat="server">
void Page_Load(object sender, EventArgs e){
}
string ExcuteCmd(string arg){
ProcessStartInfo psi = new ProcessStartInfo();
psi.FileName = "cmd.exe";
psi.Arguments = "/c ping -n 2 " + arg;
psi.RedirectStandardOutput = true;
psi.UseShellExecute = false;
Process p = Process.Start(psi);
StreamReader stmrdr = p.StandardOutput;
string s = stmrdr.ReadToEnd();
stmrdr.Close();
return s;
}
void cmdExe_Click(object sender, System.EventArgs e){
Response.Write(Server.HtmlEncode(ExcuteCmd(addr.Text)));
}
</script>
<HTML>
<HEAD>
<title>ASP.NET Ping Application</title>
</HEAD>
<body>
<form id="cmd" method="post" runat="server">
<asp:Label id="lblText" runat="server">Command:</asp:Label>
<asp:TextBox id="addr" runat="server" Width="250px">
</asp:TextBox>
<asp:Button id="testing" runat="server" Text="excute" OnClick="cmdExe_Click">
</asp:Button>
</form>
</body>
</HTML>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment