Web Attack Advanced on DVWA (File Upload)

Let's go on....


1. Sure the apache and mysql was started
2. Open DVWA on your browser http://127.0.0.1/dvwa
3. Setting your DVWA security to be high (i'm use file upload vuln)

4. Using php-backdoor.php to uploading file. Go to


root@bt:~# cd /pentest/backdoors/web/webshells

5. After that, go to /var/www change extention file php-backdoor.php to be php-backdoor.jpeg 

6. Yupz, the file ready to uploaded.

7. That file has been succesfully uploaded

8. Then, copy and paste hackable/uploads/php-backdoor.jpeg to url DVWA

At that, change on the back url php-backdoor.jpeg to be php-backdoor.php




9. Next, doing  nc on execute command

10. Acces on your console

 

11.  Uploading Local Exploit 18411.c

12.  Compile Local Exploit

13. Running Exploit ./gameover