3

So I am currently playing around with DVWA, and by exploiting the local file inclusion vuln I can manage to upload the nc.exe binary on the target server and execute a reverse shell to my machine. However I am noticing that once a shell is obtained, the DVWA website stops responding, so technically this is causing a DoS as well. Once the shell connection is ended, the website becomes responsive again.

Does anyone know why this happens and how can this be mitigated? As this would not be an ideal scenario during a live pen test.

Improve this question
4
  • You have uploaded nc.exe on the server.When you get the remote shell in the machine. How are you using netcat ? , are you redirecting commands to another shell. In that case since your server is executing the nc binary. Why should it be responsive ?.... ( I guess).. can you make a seprate thread for nc.. (Correct me if i m guessing it wrong)
    – sourav punoriyar
    Commented Jun 7, 2016 at 13:21
  • Yes you're right, the server is executing the nc binary via the PHP code in the URL. So that makes the server unable to carry out its normal functions? What's a better approach to avoid this then?
    – zyk
    Commented Jun 7, 2016 at 13:49
  • I went around this by executing another reverse shell from the first obtained shell. This way I was able to close the one executed by the server which made it responsive again. Is there a neater way doing all this? I am still very green in pen testing, so I would really enjoy some pro tips! Thanks.
    – zyk
    Commented Jun 7, 2016 at 14:01
  • Actually I have never done pen testing.... I just know basics of nc and some security. I will be starting to learn pen testing.
    – sourav punoriyar
    Commented Jun 7, 2016 at 14:35

2 Answers 2

Reset to default
3

Generally in these types of situations, you want to spawn a child process for the shell, or migrate to another process(only possible in windows).

You can check out one way of doing this in the Metasploit module for process migration in windows: https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/manage/migrate.rb

A more general overview of the process: https://security.stackexchange.com/a/92893/113752

Hacking: The Art of Exploitation, though a bit dated, provides a good overview of spawning a child process in UNIX for a reverse shell in chapter 6: https://leaksource.files.wordpress.com/2014/08/hacking-the-art-of-exploitation.pdf

The book is considered to be somewhat of a classic in InfoSec literature, it is a very good read to get a feel for C and assembly if your starting out.

Improve this answer
1

With out actually seeing it happen and being able to check logs, my best guess is that the web server is single threaded and the nc.exe is tying up that thread. As mentioned in one of the comments the cleanest way around this would be to either launch a Reverse Shell via the Reverse shell and then close it (fast enough that no one notices) or to modify the executable that you are uploading so that it does it automatically.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .