How can I open a meterpreter shell on the target server after redirecting the target server to my own web server hosting the payload?

Question

Alright, so here is what I did to a vulnhub machine after I found a XSS vulnerability in it.

1. Generated a reverse_tcp php payload and kept it within my web server.
2. Navigated to my web server's payload location via the document.location() method using the XSS exploit.
3. On my end, the msfconsole is listening to any incoming connections.
4. As soon as the target server redirects to my php payload, we get a meterpreter shell. But in like 5 min, I realized that it was a shell to my own machine and not the machine i'm trying to break into.

I'm a noob at using meterpreter and payload. Can anyone please help? I know the payload should be uploaded to the targeted server and then accessed. Can redirect to my web server not cause the payload to be executed in the targeted machine?

Answer 1

XSS vulnerabilities can be used to exploit the client, not the server (with the exception of some edge cases on NodeJS and other javascript frameworks).

You will not be able to use the php payload with a XSS vulnerability. One thing you can do is find a browser payload in metasploit (e.g. Auroroa), and exploit yourself!