# Exploitation

## Reverse shell

At this point we are beginning to establish a solid foothold on our target.

We have the ability to execute commands into the system through the web-based terminal on the Usermin dashboard.

Let's take it a notch higher by establishing a reverse shell connection into the machine through the web-based terminal.

A valuable resource I use to create reverse shell payloads is [https://www.revshells.com/](https://www.revshells.com/)

<figure><img src="https://2767776133-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnxvh3yylNIL5CjIXQGYn%2Fuploads%2F3jdmcNuXxe68F31C0E59%2Fimage.png?alt=media&#x26;token=7931fd3c-1734-455d-866e-bf91e960b31b" alt=""><figcaption><p>Creating a reverse shell payload</p></figcaption></figure>

Have your listener on

<figure><img src="https://2767776133-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnxvh3yylNIL5CjIXQGYn%2Fuploads%2FMwPYkCNmTm4J1OKi8F01%2Fimage.png?alt=media&#x26;token=115cd6b2-646d-402e-a206-262b1453ede5" alt=""><figcaption></figcaption></figure>

Let's execute our reverse shell payload on the web terminal

<figure><img src="https://2767776133-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnxvh3yylNIL5CjIXQGYn%2Fuploads%2FrgUVLoIGzUMlMcJQuM7D%2Fimage.png?alt=media&#x26;token=203f1a80-8e00-431e-9072-1c490fb60984" alt=""><figcaption></figcaption></figure>

Our listener gets a hit!

<figure><img src="https://2767776133-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnxvh3yylNIL5CjIXQGYn%2Fuploads%2FHOZrUNtjwP0VbXMm3Mgs%2Fimage.png?alt=media&#x26;token=b4c50827-c2c2-4576-87a1-ae8f4bd2efc9" alt=""><figcaption></figcaption></figure>

We now have a reverse shell connection into the target.

Our shell is however not interractive. Let's fix that.

To do that, we will need to spawn a TTY Shell. TTY Shell however uses python3. We thus need to confirm the python version our target is running.

Our target is running python3. Awesome!

<figure><img src="https://2767776133-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnxvh3yylNIL5CjIXQGYn%2Fuploads%2F0kgkWg2J3nnnB3VhyZTI%2Fimage.png?alt=media&#x26;token=204a85da-84c4-4ce4-b08c-0869543ac977" alt=""><figcaption></figcaption></figure>

Now let's spawn the TTY shell

```
python3 -c 'import pty; pty.spawn("/bin/sh")'
```

Ando now we have an interactive shell

<figure><img src="https://2767776133-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnxvh3yylNIL5CjIXQGYn%2Fuploads%2F24m3oVp7qBb1iJQekPhI%2Fimage.png?alt=media&#x26;token=5b126118-dc22-4336-98bb-a72a665e7474" alt=""><figcaption></figcaption></figure>

On listing the contents of the directory I was, I found our first flag

<figure><img src="https://2767776133-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnxvh3yylNIL5CjIXQGYn%2Fuploads%2FIcYCdMpf0WkJjRmHg26e%2Fimage.png?alt=media&#x26;token=b2a04614-e577-49c5-907f-95abf289f8d3" alt=""><figcaption></figcaption></figure>
