Targeting PHP.
In this video, we're going to be taking a look
at the process of exploiting PHP that is essentially being used
as part of the LAMP stack for the Apache web server,
as well as the web applications that are being
hosted on the target system.
So again, this is more of a specialized attack.
But it's something that a lot of beginners
will actually miss out on.
So, whenever you're performing a penetration test that
involves web applications, you need to analyze or explore
all the components that make up the actual web server, right
from the web server technology which in this case is Apache,
to the operating system, which we know is Linux, as well
as the web server technology which in this case
we know is PHP.
And of course, the database can either be MySQL or PostgreSQL.
So we are primarily going to be taking a look at identifying
a vulnerability that affects the version of PHP that's
running on the web server on the target,
and how it can be exploited to provide us
with a reverse shell.
So again, as for the lab environment,
we're using the same lab environment
that we've been using within this section.
So again, just fire it up.
Or if you're continuing on, then you
don't need to start it again.
And I'll just switch over to my lab environment,
and we can get started with the process of exploiting PHP.
All right, so I'm back within the lab environment.
And as you can, see I've performed
an nmap scan on the target.
More specifically, a service version detection scan,
and the default script scan on the target on port 80,
where we have the web server running on.
And as you can see, it's running Apache HTTPD 2.2.8, on Ubuntu,
and of course we've taken a look at how to exploit WebDAV.
So that's something we'll not be going over right now.
You can see that we have the HTTP title, as well as the HTTP
server header.
So if we try and access the web server via our browser,
we should be able to learn more about what's going on, right?
And as I said, we are targeting PHP.
So let me just copy the target IP there in my case.
So I'll just paste that in there.
And that's the web server, and again, we really
can't tell what version of PHP is running on the target.
Now, if the target system is running a LAMP stack,
or is hosting web applications designed in PHP, in some cases
diagnostic or configuration files pertinent to PHP
may be left over.
And one of them is the phpinfo.php file,
which essentially will tell you what version of PHP
is running on the target.
And in this case, you can see that the target is running
PHP version 5.2.4 on Ubuntu.
And it'll give you information regarding the system here,
the server API, as well as you can see
the server API is CGI/FastCGI.
Configuration file, that provides you
with the actual directory to the PHP configuration file,
and the loaded configuration file where this information
is obtained from.
So in terms of looking for an exploit that
affects this specific version of PHP,
you really need to be able to identify what you're
trying to exploit within PHP.
Now this specific version, or really not
the specific version, but version lower than 5.3.1
are vulnerable to a command injection
attack, or remote code execution attack, if you will.
And I can actually show you this here.
So I'll minimize that, and we can launch a search
with searchploit, and I'm going to search for php cgi.
Right?
And you can also search for the exact PHP version.
And if we take a look at this one right over here,
so PHP version is lower than 5.3.12,
or lower than 5.4.2 are vulnerable
or all of those PHP versions are vulnerable to CGI
argument injection.
So this is a manual Python exploit script here
that we'll actually be using.
So I think this is our first video where
we are going to be utilizing an exploit code that's
available on ExploitDB, instead of relying on the Metasploit
module.
I believe there is a Metasploit module
that we have for this specific version of PHP,
or these specific versions of PHP.
So, we are going to copy over the exploit.
And I'll just get the EDB ID here.
So that is 18836.
So I can say searchploit m, to copy over the exploit, 18836.
All right, so it's got the Python script there.
You can see we can actually confirm
that is indeed the exploit.
And you can open it up in a text editor.
I'll be using Vim.
And let me explain what's going on.
So these specific versions of PHP
are vulnerable to CGI argument injection exploit.
And I've already explained how CGI scripts work in the system,
and host-based attacks calls when
we were going through the shellshock vulnerability,
and taking a look at how to exploit it.
But at a very high level, this exploit
is fairly simple to use.
It's a Python 2 exploit, as you can probably already tell,
if you have developed in Python.
And the way it works, it actually
shows you the usage here.
We launched the Python script with Python 2.
We specify the target IP, or rather the target IP itself
here, and the port on which the web server is running.
And in terms of the exploit code itself,
it will actually inject PHP code for execution.
So right away, you can see that we have
a variable called pwn code.
So that is the exploit code here that we need to modify.
Now by default, the default PHP command
that has been specified here will simply
print out the PHP information that we
were able to enumerate from the web server.
So it'll just print out what we were able to get.
Now what this means is that we can actually execute PHP code,
and we can actually obtain a reverse shell
by utilizing a PHP reverse shell one-liner.
So let me just get out of VIM here.
If I say Python 2, and 18836.py, you
can see it provides you with the usage.
So we can run that again, specify the target IP, and port
80, and let's see what happens.
So you can see that it executes.
And you may be a little bit confused.
But if you take a look at the top here,
you can see that PHP, the code specified within the PHP
brackets here is PHP info.
And it prints out the exact version of PHP.
So again, this is the page that we essentially got here.
So we can modify the pwn code to provide us
with a reverse shell.
So what we'll do is we will open up the exploit again.
And within the PHP tags here, we can get rid
of the PHP info command and I've already got a one-liner.
So let me just copy it over, and I'll explain what's happening.
All right, so I've copied over the PHP reverse shell
one-liner.
And this PHP code essentially connects to our listener,
or will connect to our listeners.
So you need to specify your Kali Linux
IP within the actual quotation marks here.
And it will connect to port 1234.
It's then going to execute a Bourne shell session.
And we have the descriptors right over here.
So if this doesn't work, then we can modify the descriptors
from 3 to 4, or maybe even 5.
But let's see whether this works.
So I'm just going to copy that there.
Before I do that, I want to get my Kali Linux IP.
So I'm going to split this vertically,
and I'll say ifconfig.
And my IP address is going to be under ethernet 1,
as will yours.
But yours is going to be different.
So do take note of that.
And I'll change the IP value here to my own IP.
There we go.
And the port is just 1234.
So I'll copy that there.
And we want to paste it within the actual PHP tags here.
So I can just insert.
There we are.
So I can actually paste that directly in there.
And the syntax looks OK.
Yeah, that all looks OK.
So what we can do now is write in quit,
or just save the changes, if you're
using another text editor.
And I'll set up my Netcat listener here.
So Netcat nvlp 1234, and we should receive a reverse shell
once we execute this exploit.
All right, so I'll say Python 2, exploit
the exploit file itself.
And then the target IP, as well as
the port on which the web server is running on,
and I'll hit Enter.
And you can see that it looks like it runs successfully.
We don't really get any error code.
We can see HTTP, this is the actual HTTP response code here.
So 200, that means that it was processed just fine.
However, if we take a look at our Netcat listener,
now we get a connection, but we actually
don't obtain a bash session or a reverse shell.
Now that could be because of a few issues.
I think we can probably modify the descriptors here.
So we can change the 3 to a 4 here.
So I'll just get rid of the 3, and change that to a 4.
And I'll do that for all the descriptors there.
And if I write in quit, let me set up a new Netcat listener
here.
And I can then say Python 2, the exploit file, target IP,
and the target port.
Hit Enter.
And we obtain a reverse shell.
And in this case, we have a Bourne shell.
So to obtain a bash session, we can say bin bash i,
and we've obtained access to the target system remotely
by via reverse shell.
So we currently have access via the www-data which makes sense,
because we exploited the Apache.
We exploited the actual web server technology.
And as a result, we inherit the permissions
under which PHP executes code, which in this case www-data.
So this is currently on privileged access,
which is where we will then move on to post exploitation
and privilege escalation.
But again, that is beyond the scope of this course.
So again, we've been able to obtain access.
So I can list all the contents of the var www directory,
and we can enumerate the actual distribution information here.
So I can say cat etc release.
We can see that it's running Ubuntu 8.04.
And we can also enumerate the actual kernel
that's running, so 5.4.0, so on and so forth.
So that is how to exploit the PHP vulnerability in regards
to the actual version that's running on the target,
and how to do it manually.
Now you can also do this via the Metasploit framework module,
if you wanted to.
But what I wanted to showcase here
is that you don't need to rely on the Metasploit framework
for exploitation.
You can also utilize really well well-developed exploits
like the one we've just used here
that have been documented really well,
and that are very easy to understand in regards to what
we need to change, or what we need to modify.
And as you saw, we were able to do it.
We were able to gain access to the target system
after two modifications to the actual exploit.
And we've essentially obtained access,
and that's pretty much it from our point of view,
as a junior penetration tester.
So that is going to conclude the practical demonstration
side of this video.
All right.
So that is going to conclude the PHP exploitation
side of things.
Hopefully, you were able to identify this vulnerability
without this video.
If you haven't, well, you've learned something new.
And as I said, it's all about learning new techniques
and learning how to use new tools
and getting an understanding of how everything works.
So again, always, always take a look at public exploit code.
Take a look at how it works.
And as you were able to see during the practical
demonstration, some exploit code is developed really well,
and will not give you any errors out of the box.
And you can launch them after a few modifications.
With that being said, that's going to be it for this video,
and I'll be seeing you in the next video.