# Web Shell

## Lab 16: Command injection - Web Shell with Command injection

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FmulIFCfQSd5AUCewNRLJ%2Fimage.png?alt=media&#x26;token=36a8db0f-06b5-4712-9f0a-fb06c6aa32c5" alt=""><figcaption></figcaption></figure>

Go to upload file page form <https://127.0.0.1/index.php?page=upload-file.php>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F1OnD95GEoFqWNXETcLIG%2Fimage.png?alt=media&#x26;token=f1dbe98c-6ab2-40e7-b5af-721afe08aa58" alt=""><figcaption></figcaption></figure>

Here we can upload a php reverse shell and custom one of the shells already present into kali linux distribution at the path: /usr/share/webshells/php (in my case i choose php-reverse-shell.php)

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Fbd7XkqJTNs2uzPwOodBz%2Fimage.png?alt=media&#x26;token=5d1477fb-1b5c-46cd-a384-cc6244e1ff68" alt=""><figcaption></figcaption></figure>

adding our Kali\_IP (10.0.2.15) and choosing a port (1339), save and upload it.

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FskHM433YU8cnvNsZ3bhk%2Fimage.png?alt=media&#x26;token=e4976805-b44a-4cef-9faf-46741a7f2fbe" alt=""><figcaption></figcaption></figure>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Fu8FFi0ZQvMs0dlGhw1cO%2Fimage.png?alt=media&#x26;token=4f84024e-fde0-4374-980c-43e51f5693e9" alt=""><figcaption></figcaption></figure>

Now we need to take in listening mode on the attacker machine via netcat: nc -lvnp 1339 and go to relative web page to run the reverse shell: [https://127.0.0.1/index.php?page=/tmp/php-reverse-shell.php](https://127.0.0.1/index.php?page=php-reverse-shell.php)

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FjRTse0wEmVzFrMJrrLUR%2Fimage.png?alt=media&#x26;token=5fe01df0-8dd8-4e30-8c6d-f52c059373b3" alt=""><figcaption></figcaption></figure>
