Hello everybody and welcome to this last tutorial of the course. Today I will show
you how you can upload a reverse shell onto a web server. However, there are
multiple problems here. First of all, the filtering of extensions. So
for example, I have on my desktop it says have a nice day.php, and then I have
something here which I've clearly mistyped. Let's type a back slash, excellent! So this is
my reverse shell to which I have added th extension jpg. Primarily because, web
servers they have filters. And let's just open up our damn vulnerable app, there's
this neat upload section, Now somebody might say, well, we're not gonna get that
in a real web server or website. My answer to this, yes, you will.
Why? Well, pretty much all social websites, and any sort of a website that has client
to client interaction, and any sort of website which has tech support, or
something of a kind, and which has contact forums, 99% chance that there will
be an upload function somewhere on the site. Just have a look around, it's there,
almost all the sites have an upload function of some sort or a kind. Okay,
try to imagine a dating website. How would a dating website function
without an upload function to upload photos of people? Practically impossible.
Also, social media websites and so on. Now there are several things which you need
to take into consideration. One of them is you need to figure out which version
of PHP are they running. To do that, nope not burpsuite, not this one, excellent!
To do that you have an nmap scan, and you have --script=http-php-
version. And this is going to give you a version of HTTP, and it's gonna try to
determine which operating system is running there as well, if I'm not mistaken. But
more importantly, it will give you a PHP version of the web server. And then based
upon the version of the PHP, you will be able to exercise certain vulnerabilities.
So my version, you can find this script on the nmap website. Just
type into Google, or whatever search engine you are using, nmap PHP version
scan and it will bring you there. I hope that you know how to do that by now. If
you want to check which PHP version you are using, you can type in php5
-v, and there you go. So, lets see, PHP 5.4.39. I think that
5.3, something like that, that was vulnerable to no bite inclusion, this is
what I was trying to do here previously. So if you have, for example, php/
00.jpg, this thing would be dropped then even though it would be
recognized. This thing would be truncated, the last part anyway, but the webserver
would actually, the PHP would actually read in the jpg and it would say, oh, ok,
this is fine. And then you would have a PHP script somewhere on the server which
is amazing. OK, so first thing's first, we need to actually download our reverse
shell. Go ahead and type in pentest monkey php reverse shell. Let's see, php-
reverse-shell pentestmonkey, and there we go. So you have php-reverse-shell-1.0.tar.gz. Go
ahead and click on it, OK, save file, go ahead and open it up, click on it, extract.
Oh, you can type in quit, go to your downloads folder, it should be here
around somewhere, excellent! So in the downloads folder I
have php-reverse-shell.1.0...what? 1.0, actually, nothing else. Anyway,
you have some files here that you can read, those are licensed things, and
there's a change log as well. But, this is what you're interested in, php-reverse-shell.
You can copy it to a folder that is appropriate to you, that is completely up
to you, I have copied mine on to desktop. You can see it here, I've just renamed it
to have a nice day. You can rename it to whatever you want as long as it's not
php, and then you don't need to put this null byte here. So let me just
rename, excellent! So it's .php and I have .jpg, but let's delete .jpg for
the time being, and let's leave it at .php and let's see what happens here.
Where is it? I have so many things open down here. Keep in
mind that when you're attempting a pentest and when you're attempting to do
this, what I'm doing now, you won't be able to do it on the latest version of
PHP. So, no way, very difficult. You're better off with an SQL injection than
you are with what I am attempting to do now. This is just so you can
conduct a scan of a few servers or a mass scan because, well, not saying that
you should scan on the servers that you don't have a version to scan, but people
have been doing mass scans of the servers, and they've been figuring out
which PHP versions they are running. And if they see, like, they've made these
scripts. It's a pretty simple script. It basically says, if the version
is lower than this number, give me the IP address and
attempt to do the following. Believe it or not, there are a lot of servers out
there which are not updated. Obviously, not Facebook, or obviously not Google, or
Twitter, or something like that, but still, a large amount of sites would be
vulnerable to something of a kind. And I would strongly suggest that you take a
look at null bite, so just null bite. That is the thing that
you saw in my file name a moment ago, .php/0
0.jpg, that's gonna work on just a little bit older versions of PHP. So if
somebody didn't do the latest updates, or something of a kind, they're gonna be in
a ton load of problems. Anyway, we're gonna go to browse, have a nice day.
php, open, we're gonna say upload. Your image was not uploaded, and for some
strange reason it's popping it up here. I have no idea why. It doesn't matter. It says
your image was not uploaded so there was a problem. Let's take a look at the
source code. Obviously, on a real site you might, well, maybe not obviously, but on a
legit site you might not be able to see this, the checking mechanism. But, anyway,
it doesn't matter. You have a way of assuming this. So, it says uploaded type
needs to be image and JPEG, and upload size needs to be lesser than this. So,
what shall we do when we can't actually see this? Well, go to the upload function
and try uploading different file formats. Don't just try the standard ones, try
whatever you can. Try unorthodox ones, try the weaker ones, etc. Whatever you
can try to upload it, see what sort of error messages you get. And if you get, I
don't know, you're unable to upload one type of file, but you're able to upload
another type of file, you'll see what the filters are like and what they are doing.
And if you try to upload files of a certain size, you don't need to try to
upload a hundred of them, you can just try to upload those that are equal to
the size of your reverse shell, or that are greater than the size of your
reverse shell. In such a case, you will be able to determine whether you will be
able to upload your reverse shell or not. In the case that your reverse shell is
significantly bigger than the size allowed, look for another shell that's
smaller, these things are pretty small anyway.
So, what shall we do? We shall go to edit preferences, go to advanced network
settings, manual proxy configuration, type in 127.0.0.1, and for port 8080, press OK,
close. We're gonna start a burpsuite. It takes a while to load but well worth
the wait. Anyway, we're gonna intercept the request
in burpsuite, and then we're gonna alter it a little bit. You might have noticed
that I'm using the medium setting on the damn vulnerable app, primarily because
you're not gonna be able to do this on high setting, there is no way. If you
manage to do it feel free to post it on the net. It will be a zero-day
vulnerability and you will get the credit for it. Anyway, so it's target,
click on proxy, options, make sure that this one is ticked, 127.0.0.1
:8080. Go back to intercept, now go back to the browser.
Oops, not this one, excellent! So now what we shall do is also rename the file as I
have renamed it before. What shall we name it, .jpg. Even though you
see some sort of a picture here you're not gonna be able to open it on the site,
I'll show you. So, where is it? Okay, so browse, .jpg open,
click on upload, and now go into burpsuite. Here you're gonna be able to
reformulate the request, and to tell it pretty much whatever you want.
So it says, Content Disposition: form data; name--"uploaded"; filename--"Have A Nice
Day.php.jpg". Remove the jpg from this, and then say forward. Tell me it was
uploaded, yes, it was, excellent! Now we're gonna go ahead and copy this
part so we see the place where it was actually uploaded. Oops, we don't actually
have the .jpg, excellent! And prior to this what I've done, I mean, this is generally
not necessary now primarily because we are connecting back to ourselves, but
take a look at this. Now this is what I've done prior, if you're doing this on
two virtual machines, or something like that, you're gonna need to change it. I'm
doing it on one so it doesn't really matter that much. You enter the file, you
edit it with Nano, and then there is this part where it says change
this, quite literally, and it says change this as well. So here
you need to change the IP address to the IP address that is appropriate. I have
changed it previously, but it was also the local hosts IP
address. As I said, it doesn't matter to me now because I'm connecting to myself,
but if you're doing this on two virtual machines, and you most likely will, and in
reality you will be doing this over the Internet, you will need to change this to
an appropriate IP address. Also, you can change the port if you wish. I wouldn't
recommend using these default ports for anything. So it's 1234, change it to
whatever you want. You can put 8888 or whatever.
Anyway, control + X since that has already changed. Next up, we need to use a bit of
knowledge that we've harvested in the previous tutorial. So, netcat, ncat,
give me verbosity level, give increased verbosity level, go into
listening mode, and give me the port on which you're gonna listen, it's gonna be
1234. Press enter, and now it is listening on port 1234. Now let's
give it k for, yeah, there's no need. I'll just leave it as it is.
You see, I change my mind quite often. Anyway, now that we have this
path you can type it in here. See it's spinning, and where is the terminal?
No, that's burpsuite...
Okay, so it should be listening, and burpsuite, of course, it's not forwarding. That
was the problem. So forward, excellent, there we go. Now we have a connection to
the web server, and can't access tty; job control turned off. Okay, so no problems.
Give me ls, you see I have access. So let's go to root, tab does not work,
root, and it stands to reason that it doesn't work. Desktop, press enter, ls,
there we go. We have successfully made a full circle, and now we are in Have A Nice
Day.php.jpg. From this point on you can do whatever you want to the
machine. This was an example of a reverse shell on Linux. Linux systems and
operating systems are not invulnerable. In spite of what the internet has been
saying, they are also full of vulnerabilities. But, they get patched
really fast though. Primarily because, it's open-source, community works
non-stop on it, and vulnerabilities are discovered really fast and patched
really fast as well. So it's a very secure system in that sense. Microsoft is
a bit slower if I'm not mistaken in terms of patching these things. Probably
because it costs money and for Linux it's practically free, thanks to
thousands of volunteers worldwide who do it. But anyway, keep in mind that Linux is
not beyond, is not breakable, impregnable, it's not invulnerable. It's
an operating system like any other. It has flaws. You cannot prove that it's
impossible to break into it, you can only prove that it is possible to break into
it. In any case, I would like to say goodbye
to everybody, in the sense of tutorials. But, I'm always around
in the discussion section, so feel free to ask as many questions as you would
like to. And I do encourage you to explore new things and feel free to
ask me about them. If you are doing
some pentesting that is perhaps not related, or not included in this tutorial,
even though I have included pretty much whatever I could think of, feel free to
post such questions as well. They do not necessarily need to be related directly
to what I am doing here. Although I do not vouch for those answers, but I will
give my best to help you out there. If you ask about something within this
tutorial, I'll be able to help you there 100%. Anyway, until the next
course, or something of a kind, I bid you all farewell, and I thank you for
watching!