Compromising XAMPP servers
Getting the shell back from the victim's system is easy. However, what if the target is a web server running the latest copy of XAMPP server? Well, if you have found a vulnerable server where you can upload files by exploiting a web application-based attack, such as some of the web application attacks, including remote file inclusion, SQL injections, or any other means of file upload, you can upload a malicious PHP meterpreter and get access to the target web server.
The PHP meterpreter
To learn the method discussed previously, we need a PHP-based meterpreter shell, which we can make using the following commands:
In the preceding ...
Get Mastering Metasploit now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
