Dec 22, 2013 12:27 PM
(This post was last modified: Dec 22, 2013 02:15 PM by SIM-1241186.)
I'm bored, and feel like making a tutorial.
This one will teach you how to upload a shell to a server using the most common method.
Note: It is possible to spawn a shell using SQL Injection, but the method is very rare. This tutorial will not cover that method, but you can read it here.
Credits to HaxOr❤;
https://hackforums.net/showthread.php?tid=3806775
Now without further adue;
What is a shell?
Source:
http://en.wikipedia.org/wiki/Backdoor_Shell
Most commonly, shells are PHP. But you can find ASP shells, CGI, etc.
This tutorial will assume you've already done some post-exploitation. That you've done some SQL Injection, or XSS / whatever other method, and you have access to the most common place to upload a shell; administration panel.
First, we need to find the admin panel of our site.
There are lot's of admin scanning tools you can use.
As garbage as Havij is, it has a half decent admin scanner, which you can customize and add more appendings to.
There's some free web based ones online as well;
http://y-shahinzadeh.ir/af/
I will use this site for example:
www.artemisiabb.it
Our administration page is located at;
www.artemisiabb.it/login.php (In this case it's just a normal login with administrator info, and redirects us to admin panel).
After logging in, we look for any place we can upload an image / file.
![[Image: 326f475c4ab5dfa5aa734faaf482632e.png]](https://gyazo.com/326f475c4ab5dfa5aa734faaf482632e.png)
Now for the different methods to upload a shell:
Method #1 - Straightforward:
Always try uploading as shell.php first. This could save you a lot of time. If they don't have any filtering in place, you can get away with uploading a .php script through an image uploader.
Now if you're lucky, you can right click an image, copy image location, and try to view the directory in which images are being uploaded to. This makes it much easier for finding your shell.
In this case, we don't have it that easy.
First we navigate to where the content is being placed;
http://www.artemisiabb.it/camere.php
I named my shell "1" so, we see a "1" on the page. We click it.
http://www.artemisiabb.it/camera.php?id=49
Now we can view page source, and find our shell;
![[Image: 59658ea073811ac6b007939c405313af.png]](https://gyazo.com/59658ea073811ac6b007939c405313af.png)
Success! we have our shell:
http://www.artemisiabb.it/uploads/camere...194029.php
Method #2 - Trickery:
Okay, let's be honest. Method #1 is just a quick way to push aside what's most unlikely to work. But we're not at a loss yet.
Image uploading scripts expect, well, images. Often times you can upload as shell.php.jpg - this suffices the .jpg check, and so your file gets uploaded. When you navigate to it, sometimes the server will execute it as .php and ignore the trailing .jpg
Let's see if it works here;
http://www.artemisiabb.it/uploads/camere...01.php.jpg
Damn. This method only works sometimes, but it's worth a shot.
Screw this site. I want to give you guys a working example. So let's try another site;
http://www.55communityguide.com/includes.../image.php
![[Image: 168af6a9f1840eea1ff875e523f5d7d5.png]](https://gyazo.com/168af6a9f1840eea1ff875e523f5d7d5.png)
Success!
http://www.55communityguide.com/upload/e...ll.php.jpg
Now you may run into another problem, some uploaders are picky, and want your images to be specific dimensions! otherwise, they reject.
Luckily, we have a tool we can use to workaround that. It's called "edjpgcom" - you can Google for it, and download.
Let's say our sites upload script specifies that images must be 105x105 px.
So, we open up Paint, or whatever, and create a JPG file with those dimensions.
![[Image: c4a81380bf79d4575bb354f575eabd6f.png]](https://gyazo.com/c4a81380bf79d4575bb354f575eabd6f.png)
Save it as whatever.jpg
Now click & drag it over edjpgcom, and you will get a window to input code. There is a maximum number of lines, so I suggest you use a small script!
![[Image: 0492ff67d00781619e243e271e333252.png]](https://gyazo.com/0492ff67d00781619e243e271e333252.png)
Click OK.
Next, open CMD, and type "ren whatever.jpg whatever.php.jpg"
If your site won't accept straight .php files, you can combine this trick with what you have learned so far.
Anyways, let's try to upload it. I'll upload as .php.jpg
http://www.55communityguide.com/upload/e...er.php.jpg
Success!
Let's test it out;
From here, we could use wget to get a real shell. But I'll continue on with tutorial.
Method #3 - Obfuscation & Fuckery:
There's loads of tricks you can do to get a shell up. Just be creative. Adapt your file to the situation.
Filters often skip things. You can try to obfuscate your files extention.
Try uploading as the following:
.php%00.jpg - The infamous nullbyte! it will delete (in most cases) everything trailing after it.
.php;.jpg
.PhP.jpg
.php5 / .php4 / .php3 are valid php extentions, and are often overlooked in filters.
Just the tip of the ice burgh on this one. Plenty of other obfuscation methods you can use. Do some research.
Method #4 - Modifying POST Data:
Personally, I find this method to work the most often. You can use Firefox Addons such as Tamper Data, or Live HTTP Headers, to modify the POST data during the uploading process.
I will show you how to do it with Tamper Data;
1: Open up Tamper Data
2: Select our file shell.php.jpg
3: Click "Start Tamper"
4: Click "Upload File"
A dialogue box should come up, asking if you want to tamper.
![[Image: 4e1902441080fef0cac1004d94bf244a.png]](https://gyazo.com/4e1902441080fef0cac1004d94bf244a.png)
Click Tamper.
You now have the POST data. Scroll through and find your file.jpg.php and rename it to .php
![[Image: f8b52b22d0cc3693639058381d079158.png]](https://gyazo.com/f8b52b22d0cc3693639058381d079158.png)
Click OK, and keep pressing Submit through any dialogue boxes you get.
Assuming it worked, your shell should be uploaded as .php
Method #5 - Uploading Other Files:
Sometimes you're going to run into problems where php files aren't executing properly. It might be worth your time to upload an .htaccess which treats image files as PHP.
There's lots of tricks you can do with an .htaccess - I suggest you look into it on your own, as going into it here is an entirely different subject.
If all else fails, and there's absolutely no place to upload a file, check and see if you have any place you can edit content at all. If you can edit the page source of anything, you might be able to insert your own uploading script, and from there, proceed to uploading a shell.
You can also try uploading an upload script as upload.phtml
If successful, you should be able to upload a file / shell.
This information is all available freely scattered around the internet. I just compiled it in a somewhat neat format.
If I've made a mistake, or you feel I can improve upon something, feel free to let me know. Just do so in a constructive way. "This thread is poorly written, I feel you could edit ... and ... to be more concise, and add more pictures to help people understand easier" is better than saying "This thread fucking sucks. Skid. Not helpful at all".
Hope you guys learned some new tricks!
Happy web hacking.
Merry Christmas.
This one will teach you how to upload a shell to a server using the most common method.
Note: It is possible to spawn a shell using SQL Injection, but the method is very rare. This tutorial will not cover that method, but you can read it here.
Credits to HaxOr❤;
https://hackforums.net/showthread.php?tid=3806775
Now without further adue;
What is a shell?
Code
A backdoor shell is a malicious piece of code (e.g. PHP, Python, Ruby) that can be uploaded to a site to gain access to files stored on that site. Once it is uploaded, the hacker can use it to edit, delete, or download any files on the site, or upload their own.Source:
http://en.wikipedia.org/wiki/Backdoor_Shell
Most commonly, shells are PHP. But you can find ASP shells, CGI, etc.
This tutorial will assume you've already done some post-exploitation. That you've done some SQL Injection, or XSS / whatever other method, and you have access to the most common place to upload a shell; administration panel.
First, we need to find the admin panel of our site.
There are lot's of admin scanning tools you can use.
As garbage as Havij is, it has a half decent admin scanner, which you can customize and add more appendings to.
There's some free web based ones online as well;
http://y-shahinzadeh.ir/af/
I will use this site for example:
www.artemisiabb.it
Our administration page is located at;
www.artemisiabb.it/login.php (In this case it's just a normal login with administrator info, and redirects us to admin panel).
After logging in, we look for any place we can upload an image / file.
Now for the different methods to upload a shell:
Method #1 - Straightforward:
Always try uploading as shell.php first. This could save you a lot of time. If they don't have any filtering in place, you can get away with uploading a .php script through an image uploader.
Now if you're lucky, you can right click an image, copy image location, and try to view the directory in which images are being uploaded to. This makes it much easier for finding your shell.
In this case, we don't have it that easy.
First we navigate to where the content is being placed;
http://www.artemisiabb.it/camere.php
I named my shell "1" so, we see a "1" on the page. We click it.
http://www.artemisiabb.it/camera.php?id=49
Now we can view page source, and find our shell;
Success! we have our shell:
http://www.artemisiabb.it/uploads/camere...194029.php
Method #2 - Trickery:
Okay, let's be honest. Method #1 is just a quick way to push aside what's most unlikely to work. But we're not at a loss yet.
Image uploading scripts expect, well, images. Often times you can upload as shell.php.jpg - this suffices the .jpg check, and so your file gets uploaded. When you navigate to it, sometimes the server will execute it as .php and ignore the trailing .jpg
Let's see if it works here;
http://www.artemisiabb.it/uploads/camere...01.php.jpg
Code
The image http://www.artemisiabb.it/uploads/camere/20131222194901.php.jpg can not be displayed because it contains errors.Damn. This method only works sometimes, but it's worth a shot.
Screw this site. I want to give you guys a working example. So let's try another site;
http://www.55communityguide.com/includes.../image.php
Success!
http://www.55communityguide.com/upload/e...ll.php.jpg
Now you may run into another problem, some uploaders are picky, and want your images to be specific dimensions! otherwise, they reject.
Luckily, we have a tool we can use to workaround that. It's called "edjpgcom" - you can Google for it, and download.
Let's say our sites upload script specifies that images must be 105x105 px.
So, we open up Paint, or whatever, and create a JPG file with those dimensions.
Save it as whatever.jpg
Now click & drag it over edjpgcom, and you will get a window to input code. There is a maximum number of lines, so I suggest you use a small script!
Click OK.
Next, open CMD, and type "ren whatever.jpg whatever.php.jpg"
If your site won't accept straight .php files, you can combine this trick with what you have learned so far.
Anyways, let's try to upload it. I'll upload as .php.jpg
http://www.55communityguide.com/upload/e...er.php.jpg
Success!
Code
Warning: system(): Cannot execute a blank command in /home/retirement/public_html/upload/editor_files/whatever.php.jpgLet's test it out;
Code
http://www.55communityguide.com/upload/editor_files/whatever.php.jpg?cmd=ls -laFrom here, we could use wget to get a real shell. But I'll continue on with tutorial.
Method #3 - Obfuscation & Fuckery:
There's loads of tricks you can do to get a shell up. Just be creative. Adapt your file to the situation.
Filters often skip things. You can try to obfuscate your files extention.
Try uploading as the following:
.php%00.jpg - The infamous nullbyte! it will delete (in most cases) everything trailing after it.
.php;.jpg
.PhP.jpg
.php5 / .php4 / .php3 are valid php extentions, and are often overlooked in filters.
Just the tip of the ice burgh on this one. Plenty of other obfuscation methods you can use. Do some research.
Method #4 - Modifying POST Data:
Personally, I find this method to work the most often. You can use Firefox Addons such as Tamper Data, or Live HTTP Headers, to modify the POST data during the uploading process.
I will show you how to do it with Tamper Data;
1: Open up Tamper Data
2: Select our file shell.php.jpg
3: Click "Start Tamper"
4: Click "Upload File"
A dialogue box should come up, asking if you want to tamper.
Click Tamper.
You now have the POST data. Scroll through and find your file.jpg.php and rename it to .php
Click OK, and keep pressing Submit through any dialogue boxes you get.
Assuming it worked, your shell should be uploaded as .php
Method #5 - Uploading Other Files:
Sometimes you're going to run into problems where php files aren't executing properly. It might be worth your time to upload an .htaccess which treats image files as PHP.
There's lots of tricks you can do with an .htaccess - I suggest you look into it on your own, as going into it here is an entirely different subject.
If all else fails, and there's absolutely no place to upload a file, check and see if you have any place you can edit content at all. If you can edit the page source of anything, you might be able to insert your own uploading script, and from there, proceed to uploading a shell.
You can also try uploading an upload script as upload.phtml
If successful, you should be able to upload a file / shell.
This information is all available freely scattered around the internet. I just compiled it in a somewhat neat format.
If I've made a mistake, or you feel I can improve upon something, feel free to let me know. Just do so in a constructive way. "This thread is poorly written, I feel you could edit ... and ... to be more concise, and add more pictures to help people understand easier" is better than saying "This thread fucking sucks. Skid. Not helpful at all".
Hope you guys learned some new tricks!
Happy web hacking.
Merry Christmas.
