-1

With metasploit it is possible to open a reverse shell via meterpreter. For this you need to place a payload on the attacked server. E.g., there is an endpoint open that places files on a server, and you add the payload. I suppose this payload needs to be executed to work, how can this be done?

closed as too broad by forest, iainpb, Xiong Chiamiov, schroeder Feb 5 '18 at 20:02

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    That depends on the payload. What were you looking to do? – Noob123 Feb 4 '18 at 21:21
  • I'm looking for an overview on ways to execute a payload. In this case it is based on a pen test example I watched two years ago where an attacker placed a file on a server via a flaw in Umbraco (open source CMS where an authorization check was forgotten on file posting endpoint). Then a program could call back and start a shell. When I explained this story today I could not answer the question how the payload was executed. What are general techniques to accomplish this? You cannot add lines to bash profile or add a service via a file, how could this attacker get the payload to be executed? – Erwin Rooijakkers Feb 4 '18 at 22:31
  • Is this a web server or a local machine? – Noob123 Feb 5 '18 at 6:13
  • A web server was attacked. See symantec.com/security_response/attacksignatures/… An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. – Erwin Rooijakkers Feb 5 '18 at 8:43
  • 1
    Aha, it overwrites a file that is already executable. exploit-db.com/exploits/19671 – Erwin Rooijakkers Feb 5 '18 at 8:56
1

There are various ways to make a target machine execute code. Most of them exploit some sort of code injection or remote file inclusion, based on unfiltered user input (most of the time).

Assume the following file upload service:

A service provides example.com/upload_file.php to allow users to upload files. There is no check in place and uploaded files are stored in example.com/uploads as you can tell by uploads done in the past. You upload evil.php containing your malicious code and it is placed in example.com/uploads/evil.php.

Usually, a user would expect to be able to download the file but here it is different. The server executes this PHP-file as PHP is installed. Using this, you may make a server execute arbitrary code. The error lies in the server not filtering user input and blindly allowing files to be uploaded, which may be executables.

This is just one (very simple) technique. Others may exploit SQL-/Code-Injections like this one:

A website allows you to enter an IP and the server executes ping on this IP. Your input may be something like 8.8.8.8, which is fine. 8.8.8.8NotAnIP may be less fine, but 127.0.0.1;rm -rf ~, resulting in ping 8.8.8.8;rm -rf ~ being executed on the server, will certainly be devastating in some cases.

You question is really broad, as there are many (creative) ways to make remote machines execute code, but I hope this provided some hints and ideas.

Not the answer you're looking for? Browse other questions tagged or ask your own question.