This lab is the precursor to Lab 7.1 Exploiting Pippin. When exploiting pippin, you likely made use of a webshell to get access to /etc/passwd on the target. In this Assignment, you are going to dive a little deeper into how this actually works.
Preparation
Create a directory called webshell on kali
create a file called index.html
copy /usr/share/webshells/php/simple-backdoor.php to the Webshell directory
PHP Web Server
We can invoke a simple web server with PHP. Here's the syntax. If you are using a high port (>1024) you don't need to be root. Let's do that instead of having a root invoked webshell on our box.
Make sure you are listening on 127.0.0.1 and not 0.0.0.0 or your actual IP address. By listening on 127.0.0.1, we are not exposing our webshell to remote parties.
php -S 127.0.0.1:8090 -t.
Running our own web server
Examine the webshell
Below are the contents of the php webshell that we copied to our Webshell directory
We will be using the http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd command to query our webserver that we started above for information.
Deliverable 1: Provide a screenshot of your own /etc/passwd
Make sure you have two different terminal windows open, one for your web server and one for the commands you will be running against it.
If you need to restart the web server DONT CLOSE THE TAB. This will not shut down the process, it will still run in the background and then you will have to figure out how to kill all PHP processes in the system. Just press ctrl+C and wait until it ends the proccess.
Enter the command below to dump the /etc/passwd file!
Dump of /etc/passwd
Below is the php webserver logging a successful GET request of the /etc/passwd dump:
web server logging the /etc/password
Deliverable 2. Continuing your use of curl or your webbrowser and webshell, get/do the following:
IP Address information
running ifconfig command
Current User
whoami
Hostname
hostname
Try using your webshell and echo to create a script.sh file that has an arbitrary command in it.
Before I made the script, I wanted to figure out the correct syntax for making a normal text file.
When dealing with URL's it is best practice to put what you are typing in quotations after the curl command, so that the system won't read the speical characters you are using to execute command as URL encoding.
Example of making a file in the server "hello.txt"
Here is the creation of the actual script in my php web server:
making a bash script called evil.sh and excuted it with the bash command
curl "http://127.0.0.1:8090/simple-backdoor.php?cmd=echo+whoami+>+evil.sh"
//the command below runs the script with the command whoami
curl "http://127.0.0.1:8090/simple-backdoor.php?cmd=bash+evil.sh
