Metasploit Command Injection to Pop a Shell

Overview

The web delivery scripts primary advantage is stealth. The server and payload are both hosted on the attacking machine, so when the exploit is carried out, there is nothing written to disk on the target, making it less likely to trigger antivirus applications and other defenses.

Step 1: Fire Up DVWA

The first thing we need to do is open DVWA and log in using the default credentials.

Step 2: Find a Vulnerable Entry Point

Now we can navigate to the "Command Execution" page. For this attack to work, we have to ensure that the target application can communicate with our local machine. We can take advantage of the default functionality of this page to ping our attacking machine. Just enter the IP address and hit "submit."

After receiving a successful reply, the next thing we need to do is determine if this page is vulnerable to command injection. We can do so by appending an operating system command to the IP address we entered. Here, we will add the ls command with the && symbol and hit "submit" again.

We can see that the application responded with the contents of the current directory at the bottom, which means that a command injection vulnerability does indeed exist.

Step 3: Launch Payload

Fire up Metasploit by typing msfconsole in the terminal. We can load the delivery module with the following command.

msf > use exploit/multi/script/web_delivery

We need to choose the appropriate target type, which, in this case, is PHP. Please note that for this module to work correctly, the target needs to be set before the payload is chosen. Type show targets to get a list of available options.

msf exploit(multi/script/web_delivery) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Python
   1   PHP
   2   PSH
   3   Regsvr32
   4   PSH (Binary)

Now we can set the rest of our options.

Finally, we are ready to launch the attack. Type run at the prompt to start the exploit. The server on our local machine will start. The last line provided by running the exploit, as seen below, is important because it shows the command that needs to be executed on the target system.

Step 4: Run the Attack

We can use the command injection vulnerability that we discovered earlier as an easy means of attacking. So copy the last line and append it to the IP address with && in the "Command Execution" page in DVWA, just like we did earlier when seeing if the page was vulnerable in the first place.

If everything goes according to plan, once we hit "submit," our payload will execute and a Meterpreter session will be opened.

We are not automatically dropped into the session, though, so we can use the sessions command to view the active sessions that are open.

To interact with an active session, use the sessions -i command followed by the appropriate session ID number.

Now we can run Meterpreter commands like getuid and sysinfo to display information about the target machine. We can also drop into a shell by using the shell command.

By exploiting command injection in a vulnerable web application, we were able to execute a shell on the target without writing anything to disk.

Since this exploit avoids writing anything to disk, it increases the chances of success in evading antivirus solutions.

In the world of security, there are often many creative ways to combine different techniques to achieve results, all you have to do is look.