> For the complete documentation index, see [llms.txt](https://edu.noirchapeau.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://edu.noirchapeau.com/shells-and-payloads-shell-overview/shells-and-payloads-web-shells-overview.md).

# Shells & Payloads: Web Shells Overview

## Web Shells Overview

* **Web Apps as Targets:**
  * Common attack vector in external pentests (file uploads, SQLi, RFI/LFI, etc.).
  * Password spraying and social engineering also key methods.
* **Web Shell Upload:**
  * Web shells often uploaded via file upload forms, profile pic uploads, or misconfigurations (e.g., Tomcat, FTP).
* **What is a Web Shell?**
  * Browser-based shell for interacting with the server OS.
  * Gained via file upload vulnerabilities.
  * Allows remote code execution (RCE), but can be unstable.
* **Persistence:**
  * Web shells may be deleted over time; typically upgraded to a more stable reverse shell.

## **Laudanum Web Shell**

* **What is Laudanum?**
  * A collection of pre-made web shell files for multiple languages (PHP, JSP, ASP, etc.).
  * Allows reverse shell access and command execution via a browser.
  * Built into Parrot OS and Kali; other distros need manual installation.
* **Working with Laudanum:**
  * Found in `/usr/share/laudanum` on Kali/Parrot.
  * Modify shell files (e.g., add attacker's IP) before use.
  * Ensure to read file comments for correct usage.
* **Using Laudanum:**
  * Copy shell file (e.g., `shell.aspx`) to a new location:
    * `cp /usr/share/laudanum/aspx/shell.aspx /home/tester/demo.aspx`
  * Modify IP in the shell file to your attacker's IP.
  * Upload shell via the vulnerable web app (e.g., upload function on status page).
* **Accessing the Shell:**
  * After upload, navigate to the shell path (e.g., `status.inlanefreight.local/files/demo.aspx`).
  * Once accessed, issue commands (e.g., `systeminfo`) to interact with the server.

## **Antak Webshell**

* **ASPX Overview:**
  * **ASPX (Active Server Pages Extended)**: Used with ASP.NET on Windows servers to generate web forms and handle user data.
  * ASPX-based web shells allow remote control of Windows systems via the web server.
* **Antak Webshell:**
  * **Antak**: An ASPX web shell part of the Nishang project, utilizing PowerShell for interacting with Windows servers.
  * **Location**: `/usr/share/nishang/Antak-WebShell`.
  * Powerful: Executes commands as new processes, runs scripts in memory, and encodes commands.
* **Working with Antak:**
  * Copy shell to a working directory:
    * `cp /usr/share/nishang/Antak-WebShell/antak.aspx /home/administrator/Upload.aspx`
  * Modify the shell: Add credentials (user/pass) for security, remove ASCII art/comments to evade detection.
* **Using Antak:**
  * Upload the modified shell to a web application.
  * Access via the browser and enter credentials to interact with the system.
  * Run PowerShell commands, upload/download files, and execute encoded scripts through the web shell.
  * Start with `help` to explore available commands.

## **PHP Web Shells**

* **PHP Overview:**
  * **PHP**: A widely used open-source scripting language, essential for dynamic web pages. Powers 78.6% of websites (W3Techs, 2021).
  * PHP processes server-side, making it possible to use pre-written payloads to exploit vulnerabilities and gain a shell or reverse shell access.
* #### **Practical Example (rConfig):**
  * **rConfig**: A web app using PHP that allows device management. Can be targeted for web shell upload.
  * **Target:** Upload a PHP web shell via the "Add Vendor" page (uses `.png`, `.jpg`, `.gif` file restrictions).
* **Exploiting File Upload Restriction:**
  * **Burp Suite**: Used to intercept and modify the request to bypass file type restrictions by changing the `Content-Type` header to `image/gif` for a `.php` file.
  * **Process:**
    * Configure browser to use Burp as a proxy.
    * Upload the PHP web shell via the "Browse" button.
    * Modify `Content-Type` from `application/x-php` to `image/gif` in Burp.
    * Forward the request and complete the upload.
* **Using the Web Shell:**
  * Once uploaded, navigate to `/images/vendor/connect.php` on the rConfig server to trigger the PHP shell and gain command execution on the server.
  * **Result**: Non-interactive shell session in the browser, where commands can be executed on the OS.

## **Considerations with Web Shells:**

* Web apps may auto-delete files after a period.
* Limited interactivity may hinder progress (e.g., chaining commands like `whoami && hostname`).
* Web shells can be unstable and easily detectable.
* In engagements, aim for stealth: delete payload after establishing a reverse shell to avoid detection.
* **Documentation**: Track methods, payload names, upload locations, and hashes (e.g., SHA1, MD5) for reporting.