In this video, we are going to see how we can chain multiple vulnerabilities to exploit dvwa.
We are going to solve.
Five Upload high difficulty challenge with command injection.
First of all, go to security settings and set the difficulty to high.
Now create an MSF random payload.
And start a multi handler with Metasploit.
Now upload the file.
The file will not be uploaded.
We have already seen that in medium difficulty.
The server checks for file content type and if it is not a jpeg image, it does not upload it.
However, in high difficulty the server checks for the file type as well.
We can bypass it by appending content-type header in the file itself.
So add gif 89 alpha on top of your exploit file.
Rename your file to exploit dot php dot jpg and upload it.
The file will be uploaded.
Now we need to exploit some other vulnerability to make the file work.
If we do have command injection on our target, you can use the command as shown on the screen to rename
the file back to PHP.
No.
Browse to the uploaded file and we will get the reverse shell.
Now let's see the demonstration on Dvwa.
Set the security level to high.
Go to file upload.
Now create an MSF venom payload with the command as shown on the screen.
Use your local IP to create the payload.
Don't try to upload it.
And you can see that our image was not uploaded.
We'll rename the exploit file with exploit dot jpeg to make it appear as an image.
Now let's try to upload it again.
However, it still doesn't get uploaded.
Now open the contents of the file with Nano.
And add 89 Alfa on top of it to make it appear like an image.
Now upload the file.
And you can see that our file gets uploaded.
However, if you try to navigate it.
You get 404 not found.
However, if you try to open it in your browser, you get an error.
Now let's run the multi handler.
Run MSF console.
Use the exploit multi handler.
Set your payload to PHP interpreter reverse TCP.
Set your host to your local IP.
And run it.
Now try to open the file in the browser again.
And we do not get any shell.
Now let's move back to.
Go to command injection.
And list down the files.
Now rename the uploaded file back to exploit dot PHP.
And you can see that we have renamed the file.
So try to open the file again.
And you can see that we get the reverse MetaFilter share.
So in this manner we can chain multiple vulnerabilities to exploit or target.