Gaining an Initial Foothold
Now that we’ve found a potential attack vector, let’s attempt to exploit it.
First, we must determine the parsing engine that is used,
and the file upload location.
Let’s inspect the HTML code.
According to the source, the application is using .NET.
Let’s create a dummy .NET file with the aspx extension.
The code specifies that we intend to use C# inside the script tags.
Since there is no code between the tags, nothing will execute,
but initially we’ll simply upload it through the web interface
and attempt to access it from the web root directory.
If the file is written to the web root or a subdirectory that does not require
authentication, we can trick the web server into executing it which,
in this case, should result in a blank page.
Let’s upload the file and attempt to browse to it.
Unfortunately, this produces a “not found” message.
Let’s enumerate subfolders on the web server
and attempt to invoke our code from there.
We’ll use Gobuster, which is faster for this simple task than other tools
like dirb.
We’ll execute Gobuster with the dir option to search for directories
along with the -e flag to display full URI paths.
We’ll also provide the target URL,
and wordlist file.
Our enumeration only returned the custom upload subdirectory.
When we browse to our file under this directory,
we receive a blank page. This likely indicates that our code is running.
The attack from here is relatively straightforward.
We can simply generate an aspx web shell with msfvenom that contains
a Meterpreter reverse shell, upload it through the application,
and browse to it under upload.
This should trigger execution and grant us a reverse shell.
We’ll start by generating our payload in aspx format,
saving the output to a file in our home directory.
Next, we’ll set up our Metasploit listener.
Now let’s upload our shell,
and attempt to browse to it.
Unfortunately, we don’t receive a shell,
and the browser displays an error message.
This clearly indicates the presence of antivirus software
that’s flagging our web shell.
Our next step is to attempt to bypass the antivirus protection
using the skills we discussed earlier in this course.
To begin, we’ll open met.aspx in an attempt to determine why it’s flagging.
The content of this file matches our previously-developed
basic C# shellcode runner.
As we know from previous efforts,
this code is flagged by both signature and heuristics scans.
Fortunately, we developed an efficient bypass.
We’ll use a non-emulated API and encrypt the Meterpreter shellcode
with a simple Caesar cipher.
Since we previously developed code for these techniques,
we can quickly incorporate them into this web shell.
First, we copy the DllImport statements
needed for VirtualAllocExNuma and GetCurrentProcess,
along with the code to call VirtualAllocExNuma
and parse its return value.
Since the web shell does not import the System.Runtime.InteropServices namespace
at a global level, we include it in each import statement.
Now we ’ll use our previously-developed code to encrypt the shellcode,
and arbitrarily use “5” as the Caesar cipher key.
Now we can execute the encryption code.
Next, we’ll copy the encrypted shellcode into the web shell.
We’ll also add the corresponding decryption routine.
With all the antivirus bypass code implemented in the web shell,
we can upload it through the web form,
and execute it.
This successfully bypasses the AV and yields us a reverse shell.
From the output of the getuid and sysinfo commands,
we find that the shell executed in the context
of the default IIS service account,
on the WEB01 host in the EVIL domain.