I am accessing an intentionally vulnerable VM hosting an older version of Wordpress. I have admin access to the Wordpress site and have been trying to use pentestmonkey's php-reverse-shell script to gain access to the box. As directed, I updated the $ip and $port to my attacker IP and set the port to 7777 (have also tried 1234 and 4321), then replaced the 404.php code in the template with the php-reverse-shell code. My netcat call is as follows:

nc -lvp 7777

When trying to hit the site, it finds the 404.php page in less than a second instead of hanging on the site and waiting for netcat to respond.

I have tried changing the 404.php code to other options, such as 'test' or a simple php script to wait for 10 seconds, both of which work appropriately in the browser. I have also tried turning off the firewall on my host machine (which has the guest, attacker VM installed and running through VMWare Workstation). Any other ideas as why this won't connect back to netcat?

**I have successfully used netcat to communicate from my host to guest (Windows to Linux). The issue is from the web app hosted elswhere back to my guest (Linux) box.

  • Try utilizing another php script to isolate whether or not the script is the problem. It's always possible you inadvertently deleted something / moved something when editing the variables for your call back. – DKNUCKLES Oct 27 '17 at 15:05
  • I was able to generate a script using Weevely and successfully gained shell access. Still not sure what happened with the php-reverse-shell script, but using Weevely took me to the same place. – LemonDev Oct 27 '17 at 15:28
  • Something must be wrong with my settings. I just tried to use reverse_tcp in Metasploit and it was having an issue connecting as well. – LemonDev Oct 27 '17 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.