Hello, everybody, and welcome to this last tutorial of the course.
Today, I will show you how you can upload a reverse shell onto a web server.
However, there are multiple problems here.
First of all, the filtering of extensions.
So, for example, I have on my desktop, have a nice day .php,
and then I have something here, which I have clearly striped.
So backslash.
Excellent, so this is a reverse shell of which I have added the extension GPG,
primarily because, web servers they have Filters.
And let's just open up our vulnerable app.
There's this neat upload section.
Now, somebody might say well we're not gonna get that from a real web server, or
website, my answer to this, yes you will.
Why?
Well, pretty much all social websites and
any sort of a website, that has client to client interaction.
And any sort of website which has tech support of that kind and
which has contact forums,
there's a 99% chance there will be an upload function somewhere on the site.
Just have a look around.
It's there almost all the sites have an upload function of some sort or kind.
Okay, just take a try to imagine a dating website.
How would a dating website function,
without an upload function to upload photos of people?
Practically impossible.
Also, social media websites and so on.
There are several things which you need to take into consideration.
One of them is you need to figure out which version of PHP are they running.
To do that, you will have an nmap scan.
And you have script equals http-php-version, and this is gonna give
you a version of HTTP, and it's gonna try to determine which operating system is
running there as well, if I'm not mistaken.
But more importantly, it will give you a PHP version of the web server, and
then based upon the version of the PHP,
you will be able to exercise certain vulnerabilities.
So, my version, you can find the script on the Nmap website.
Just type into Google, or
whatever search engine you are using.
Nmap PHP version scan and it will bring you there.
I hope that you know how to do that by now.
If you want to check which PHP version you are using,
type in php5-V, and there you go.
So let's see, php 5.4.
So 5439. You think that 53,
something like that was vulnerable to no byte inclusion.
This is what I was trying to do here previously.
You have, for example, php/00.jpg.
This thing would be dropped, and even though it would be recognized.
Truncated the last part anyway, but the web server would, the PHP,
would actually read in the JPEG and it would say, this is fine.
And then you would have a PHP script, somewhere on the server, which amazing.
Okay, so first thing's first.
We need to actually our reverse shell.
Go ahead and type in 10 test monkey php refer let's see.
Php-reverse-shell, pentestmonkey.
And there we go.
So you have php-reverse-shell-1.0 tar.gz.
Go ahead and click on it.
Okay, save file.
Go ahead and open it up.
Click on it, extract.
I'll type in quit.
Go to your downloads folder.
It should be here around somewhere.
Excellent. So, in the downloads folder,
I have PHP reverse shell 1.0, what.
1.0 actually.
Nothing else.
Anyway, you have some files here that you can read.
Those are license things and there's a change log as well.
But, this is what you're interested in.
PHP reverse shell.
You can copy it to a folder that is appropriate to you.
That is completely up to you.
I have copied mine onto desktop.
You can see it here.
I just renamed it into have a nice day.
You can rename it whatever you want, as long as it's not PHP.
And then you don't need to put this note right here.
So, let me just rename.
Excellent, so it's .php and I have .jpeg, but let's delete .jpeg for
the time being, and let's leave it at .php, and let's see what happens here.
Where is it?
I have so many things open down here.
Keep in mind that when you're attempting a pen test and
when you're attempting to do this, what I'm doing now,
you won't be able to do this on the latest version of PHP so, no way.
Very difficult, you're better off with an SQL injection,
than you are with what I am attempting to do now, this is just so.
You can conduct a scan of a few servers, or a mass scan because, well, not
saying that you should scan the servers that you don't have permission to scan.
But people have been doing mass scan of the servers,
and they've been figuring out which PHP versions they are running.
And if they see they've made these scripts.
It's a pretty simple script.
It basically says if the version is lower than this number,
give me the IP address, and attempt to do the following.
Believe it or not, there are a lot of servers out there which are not updated.
Obviously, not Facebook, or obviously, not Google or Twitter or something like that.
But still a large amount of sites would be vulnerable to something
of that kind, and I would strongly suggest that you take a look at null bite.
So just, null bite.
That is the thing that you saw in my file name a moment ago, like,
back dot PHP/00.jpg.
That's gonna work on just a little bit older versions of PHP so
if somebody didn't do the latest updates or
something of that kind, they're gonna be in a ton load of problems.
Anyway, we're gonna go to browse,
have a nice day dot PHP, open, we're gonna say upload.
You're image was not uploaded and for some strange reason it's popping it up here.
I have no idea why?
It doesn't matter.
It says your image was not uploaded so there was a problem.
Let's take a look at the source code.
Obviously on a real site you might, well maybe not obviously, but
on a legit site you might not be able to see this, the checking mechanism.
Anyway, it doesn't matter, you have a way of assuming this.
So it says, upload the type needs to be image and
jpeg and upload size needs to be lesser than this.
So, what shall we do when we can't actually see this?
Well, go the the Upload function and try uploading different file formats.
Don't just try the standard ones, try whatever you can.
Try the unorthodox ones, try the weaker ones, etc.
Whatever you can, try to upload it,
see what kind of error messages you get.
And, if you are unable to upload one type of file, but
you are able to upload another type of file,
you will see what the filters are like, and what they are doing.
And if you try to upload files of certain size, you don't need to try
to upload 100 of them, you can just try to upload those that are equal to the size
of your reverse shell, or that are greater than the size of your reverse shell.
In such a case you will be able to determine,
whether you will be able to upload your reverse shell or not.
In case that your reverse shell is significantly bigger than the size
allowed, look for another shell that's smaller.
These things are pretty small anyway.
So what shall we do?
We shall go to Edit > Preferences > Advanced > Network > Settings.
Manual proxy configuration, type in 127001 and for Port 8080.
Press OK.
Close. We're gonna start a burpsuite.
Takes a while to load, but well worth the wait.
Anyway, we're going to intercept the request in BurpSuite, and
then we're going to alter it a bit,
you might have noticed that I'm using the media setting on the downloadable app,
primarily because you are not going to be able to do this, on high setting.
There is no way, if you manage to do it, feel free to post it on the net,
it will be a zero day vulnerability, and you will get the credit for it.
Anyway so it's target, click on Proxy.
Options, make sure that this one is ticked 127001:8080.
Go back to intercept.
Go back to the browser.
Not this one.
Excellent.
Now, what we shall do is also rename the file as I have renamed it before.
Dot, what shall we name it, jpg.
And even though you see some sort of a picture here you're not gonna be
able to open it on site, I'll show you.
So where is it?
Okay, so browse. Open. Click on Upload and now go into berg suit.
Here you're going to be able to reformulate the request,
and to tell it pretty much whatever you want.
So it says content disposition form data name uploaded.
File name, haveaniceday.php.jpg.
Remove the jpg from this and then say forward.
Tell me it was uploaded.
Yes it was.
Excellent.
We're gonna go ahead and copy this part, so we see the place where it
was actually uploaded.
Ups we don't actually in the JPG.
Excellent and prior to this what I've done.
I mean this is generally not necessary now primarily,
because we are connecting back to ourselves, but take a look at this.
Now, this is what I've done prior, if you're doing this on two virtual machines,
or something like that, you're gonna need to change it.
I'm doing it on one, so it doesn't really matter that much.
You enter the file, you edit it with Nano, and there is this part,
where it says change this, quite literally and it says here change this as well.
So here you need to change the IP address to the IP address that is appropriate.
I have changed it previously, but it was also global host site IP address.
As I said it doesn't matter to me now, because I'm connecting to myself.
But if you're doing this on two virtual machines and
you most likely will- and in reality you will be doing this over the internet.
You will need to change this to an appropriate IP address.
Also you can change the port if you wish,
I wouldn't recommend using these default ports for anything.
So it's one, two, three, four.
Change it to whatever you want, you can put eight-eight-eight or whatever.
Anyway control x since that is already changed next up we need
to use a bit of knowledge that we harvested in the previous tutorial so
net cat n cat give me verbosity level increase verbosity level
give me demoed go into listening mode Give me the port on which you're gonna listen.
It's gonna be 1234,
press enter and now it is listening on port 1234.
Now let's give it k for, there's no need, let's just leave it as it is.
You see I change my mind quite often.
Anyway, now that we have this math, you can type it in here.
See it's spinning, and where is the terminal
nope that [INAUDIBLE] Okay so it should be listening and
the burp suite of course is not forwarding that was the problem so
forward exon there we go now we have a connection to the web server and
can't access tty job control turned off So now problems.
Give me LSTC. I have access.
So lets go to root of stab does not work.
Root, and it stands to reason that doesn't work.
Desktop. Press enter.
LS. There we go.
We have successfully made it full circle.
And now we are in.
Have a nice day.
php.jpg.
From this point on, you can do whatever you want to the machine.
This was an example for virtual on Linux.
Linux systems and operating systems are not invulnerable,
in spite of what the internet has been saying.
They are also full of vulnerabilities.
But they get patched really fast though.
Primarily because it's an open source, community works, non-stop on it.
And vulnerabilities are discovered really fast and patched really fast as well.
So it's a very secure system in that sense.
Microsoft is a bit slower, if I'm not mistaken, in patching these things.
Probably because it costs money and for Linux it's practically free.
Thanks to thousands of volunteers worldwide who do it.
But anyway. Keep in mind that Linux is not beyond,
is not unbreakable, impregnable.
It's not invulnerable.
It's an operating system like any other.
It has flaws, you cannot prove that it's impossible to break into it,
you can only prove that it is possible to break into it.
In any case I would like to say goodbye to everybody,
in the sense of tutorials, but I will.
I'm always around in the discussion section.
So feel free to ask as many questions as you would like to.
And I do encourage you to explore new things and
you can feel free to ask me about them if you have.
If you're doing some pen testing that is perhaps not related or not included in
this tutorial even though I've included pretty much whatever I I could think of.
Feel free to post such questions, as well.
They do not necessarily need to be related directly to what I am doing here,
although I do not vouch for those answers.
But I will give my best to help you out there.
If you ask about something within this tutorial,
I'll be able to help you there 100%.
anyway, until the next course or something of that kind I bid you all farewell.
And I thank you for watching